CVE-2026-33173
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
How to fix
- rubyonrails rails7.2.3.1, 8.0.4.1, 8.1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubyonrails rails | v < 7.2.3.1, 8.0.0 ≤ v < 8.0.4.1, 8.1.0 ≤ v < 8.1.2.1 | 7.2.3.1, 8.0.4.1, 8.1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.