CVE-2026-33173
CVE-2026-33173 — Rails Active Storage has possible content type bypass via metadata in direct uploads
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Published Updated Sources: cvelistV5, GitHub_M
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
0%
chance of exploitation in 30 days
CVSS base
5.3
MEDIUM
CISA SSVC assessment
Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.
Exploitation
None
none · proof-of-concept · active
Automatable
No
can an attacker script all four kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (1)
Products (1)
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 5.3 | CVSS 4.0 | MEDIUM | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-925
References
7 on the record
- github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
x_refsource_CONFIRM
- github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
x_refsource_MISC
- github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
x_refsource_MISC
- github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
x_refsource_MISC
- github.com/rails/rails/releases/tag/v7.2.3.1
x_refsource_MISC
- github.com/rails/rails/releases/tag/v8.0.4.1
x_refsource_MISC
- github.com/rails/rails/releases/tag/v8.1.2.1
x_refsource_MISC
Elsewhere on this site
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.