CVE-2026-33202
CVE-2026-33202 · Rails Active Storage has possible glob injection in its DiskService
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
CVSS 6.6 · Medium · EPSS 0.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
activestorage
- Versions
- >= 8.1.0.beta1, < 8.1.2.1: Affected
- >= 8.0.0.beta1, < 8.0.4.1: Affected
- < 7.2.3.1: Affected
No fix published
rails Debian:12
- Versions
- 2:6.1.7.10+dfsg-1~deb12u1
- 2:6.1.7.10+dfsg-1~deb12u2
- 2:6.1.7.3+dfsg-1
- 2:6.1.7.3+dfsg-10
- 2:6.1.7.3+dfsg-11
- 2:6.1.7.3+dfsg-12
- 2:6.1.7.3+dfsg-13
- 2:6.1.7.3+dfsg-2
- 2:6.1.7.3+dfsg-2~deb12u1
- 2:6.1.7.3+dfsg-3
- 2:6.1.7.3+dfsg-4
- 2:6.1.7.3+dfsg-5
- 2:6.1.7.3+dfsg-6
- 2:6.1.7.3+dfsg-7
- 2:6.1.7.3+dfsg-7~exp1
- 2:6.1.7.3+dfsg-8
- 2:6.1.7.3+dfsg-9
- Affected ranges
- ECOSYSTEM: < 2:6.1.7.10+dfsg-1~deb12u3
Update to 2:6.1.7.10+dfsg-1~deb12u3
rails Debian:13
- Versions
- 2:7.2.2.1+dfsg-7
- 2:7.2.2.2+dfsg-1
- 2:7.2.2.2+dfsg-2~deb13u1
- Affected ranges
- ECOSYSTEM: < 2:7.2.2.2+dfsg-2~deb13u2
Update to 2:7.2.2.2+dfsg-2~deb13u2
rails Debian:14
- Versions
- 2:7.2.2.1+dfsg-7
- 2:7.2.2.2+dfsg-1
- 2:7.2.2.2+dfsg-2
- 2:7.2.2.2+dfsg-2~deb13u1
- 2:7.2.2.2+dfsg-2~deb13u2
- 2:7.2.3+dfsg-1
- 2:7.2.3+dfsg-2
- 2:7.2.3+dfsg-3
- Affected ranges
- ECOSYSTEM: < 2:7.2.3.1+dfsg-1
Update to 2:7.2.3.1+dfsg-1
rails Ubuntu:Pro:16.04:LTS
- Versions
- 2:4.1.10-1
- 2:4.2.5-1
- 2:4.2.5.1-1
- 2:4.2.5.2-2
- 2:4.2.6-1
- 2:4.2.6-1ubuntu0.1~esm1
- 2:4.2.6-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Ubuntu:Pro:18.04:LTS
- Versions
- 2:4.2.9-2
- 2:4.2.9-4
- 2:4.2.10-0ubuntu4
- 2:4.2.10-0ubuntu4+esm1
- 2:4.2.10-0ubuntu4+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Ubuntu:Pro:20.04:LTS
- Versions
- 2:5.2.2.1+dfsg-1ubuntu1
- 2:5.2.3+dfsg-3
- 2:5.2.3+dfsg-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Ubuntu:Pro:22.04:LTS
- Versions
- 2:6.0.3.7+dfsg-2
- 2:6.1.4.1+dfsg-8ubuntu2
- 2:6.1.4.1+dfsg-8ubuntu2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Ubuntu:24.04:LTS
- Versions
- 2:6.1.7.3+dfsg-2build1
- 2:6.1.7.3+dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Ubuntu:25.10
- Versions
- 2:6.1.7.3+dfsg-7
- 2:7.2.2.1+dfsg-7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Ubuntu:26.10
- Versions
- 2:7.2.3+dfsg-2
- 2:7.2.3.2+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Ubuntu:26.04:LTS
- Versions
- 2:7.2.2.1+dfsg-7
- 2:7.2.2.2+dfsg-2
- 2:7.2.3+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-33202