CVE-2026-33195
CVE-2026-33195 — Rails Active Storage has possible Path Traversal in DiskService
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Published Updated Sources: cvelistV5, GitHub_M
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
1%
chance of exploitation in 30 days
CVSS base
8.1
HIGH
CISA SSVC assessment
Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.
Exploitation
None
none · proof-of-concept · active
Automatable
Yes
can an attacker script all four kill-chain steps
Technical impact
Total
partial · total control of the vulnerable component
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 8.1 | CVSS 3.1 | HIGH | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-22
References
10 on the record
- github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
x_refsource_CONFIRM
- github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
x_refsource_MISC
- github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655
x_refsource_MISC
- github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
x_refsource_MISC
- github.com/rails/rails/releases/tag/v7.2.3.1
x_refsource_MISC
- github.com/rails/rails/releases/tag/v8.0.4.1
x_refsource_MISC
- github.com/rails/rails/releases/tag/v8.1.2.1
x_refsource_MISC
- access.redhat.com/security/cve/CVE-2026-33195
vdb-entry, x_refsource_REDHAT
Elsewhere on this site
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.