Red Hat CVE-2026-33173

Immediately upgrade Rails to patched versions: 7.2.3.1 or later, 8.0.4.1 or later, or 8.1.2.1 or later, as appropriate for your deployed version. The patches are available via standard RubyGems channels and GitHub releases (see https://github.com/rails/rails/releases). Until patching is completed, restrict access to the DirectUploadsController to authenticated users only via application-level authorization checks, and consider disabling direct uploads entirely if not essential to your application workflow. Review any custom metadata handling code that may interact with blob metadata to ensure it does not assume server-side control of the 'identified' or 'analyzed' flags. The committed fixes (available at the GitHub commit hashes provided in the advisory) implement proper server-side validation to prevent client-supplied metadata from overwriting reserved internal flags.