Skip to main content

CVE-2026-33195

HIGH
Path Traversal (CWE-22)
2026-03-23 https://github.com/rails/rails GHSA-9xrj-h377-fr87
Path Traversal
8.0
CVSS 4.0 · Vendor: https://github.com/rails/rails
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted blob key with path traversal sequences
  2. Exploit
    DiskService#path_for resolves path outside storage root
  3. Execution
    Access arbitrary filesystem files
  4. Impact
    Read, write, or delete sensitive data

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Rails applications using Active Storage's DiskService where user input is passed unsanitized as blob keys. No authentication required. Remote unauthenticated attacker can exploit via crafted blob keys containing path traversal sequences (e.g., ../) to read, write, or delete arbitrary server files. Default configuration vulnerability if applications don't sanitize blob key inputs.
Impact

The real-world risk depends heavily on application-specific implementation patterns. While the vulnerability enables severe impacts (arbitrary file system access), exploitation requires applications to pass user-controlled input directly as blob keys, which contradicts typical Active Storage usage patterns where keys are framework-generated identifiers. No CVSS score has been assigned yet, and EPSS probability data is unavailable for this recent 2026 CVE. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept exists in the provided intelligence. The attack likely requires network access to the application and knowledge of the storage implementation, increasing complexity. Priority should be elevated for applications that deviate from standard Active Storage patterns by exposing blob key parameters to user input, but many Rails applications following best practices may have limited practical exposure despite the theoretical severity.
Exploit ScenarioDerived

An attacker identifies a Rails application that accepts user-provided blob identifiers through an API endpoint or form parameter instead of using framework-generated keys. The attacker crafts a malicious blob key containing path traversal sequences such as '../../etc/passwd' or '../../config/database.yml' and submits it through the vulnerable interface. The DiskService#path_for method resolves this to a filesystem path outside the storage root, allowing the attacker to read sensitive configuration files, overwrite application code, or delete critical system files depending on the web server's filesystem permissions.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 23, 2026

Active Storage's DiskService component in Ruby on Rails contains a path traversal vulnerability (CWE-22) that fails to validate resolved filesystem paths remain within the storage root directory. Applications passing untrusted user input as blob keys are vulnerable to arbitrary file read, write, or deletion operations on the server. Patches are available in Rails versions 7.2.3.1, 8.0.4.1, and 8.1.2.1, with no current evidence of active exploitation or public proof-of-concept code.

RemediationAI

Upgrade Ruby on Rails to version 7.2.3.1, 8.0.4.1, or 8.1.2.1 depending on your current release series. Official patched releases are available at https://github.com/rails/rails/releases/tag/v7.2.3.1, https://github.com/rails/rails/releases/tag/v8.0.4.1, and https://github.com/rails/rails/releases/tag/v8.1.2.1. The fixes are implemented in commits 4933c1e3b8c1bb04925d60347be9f69270392f2c, 9b06fbc0f504b8afe333f33d19548f3b85fbe655, and a290c8a1ec189d793aa6d7f2570b6a763f675348. Until patching is completed, immediately audit application code to ensure blob keys are never derived from user input and implement strict input validation on any parameters that could influence file storage paths. Consider temporarily switching to cloud storage services if DiskService cannot be secured immediately, as cloud providers typically implement their own path validation.

Affected Packages

rubygems activestorage fix: 7.2.3.1, 8.0.4.1, 8.1.2.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects the Active Storage component (pkg:rubygems/activestorage) in Ruby on Rails, specifically the DiskService#path_for method responsible for resolving blob storage paths on local filesystems. The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. When blob keys containing directory traversal sequences like '../' are processed, the method fails to sanitize or validate that the computed path remains within the designated storage root, allowing filesystem access outside intended boundaries. Active Storage is Rails' framework for uploading files to cloud services or local disk storage, and the blob key is typically a trusted identifier generated by the framework, though some applications may inadvertently expose this parameter to user-controlled input.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/rails/rails) PRIMARY 8.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.1 HIGH

Primary rating from Vendor (https://github.com/rails/rails).

CVSS VectorVendor: https://github.com/rails/rails

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 30, 2026 - 03:24 NVD
CRITICAL HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
9.8 (CRITICAL) 8.0 (HIGH)
Patch released
Mar 23, 2026 - 21:30 nvd
Patch available
CVE Published
Mar 23, 2026 - 21:17 nvd
CRITICAL 9.8

DescriptionCVE.org

Impact

Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.

Releases

The fixed releases are available at the normal locations.

Executive ViewAI

Why It Matters

A path traversal vulnerability in Ruby on Rails' Active Storage component could allow attackers to read, modify, or delete files on affected servers if applications accept untrusted user input for file operations. Organizations running vulnerable Rails versions with user-facing file upload or storage features face potential data breach, data loss, and service disruption risks.

Business Impact: High
Compensating Controls

Apply vendor patch. If patching cannot be completed immediately: implement strict input validation and sanitization on blob key parameters; restrict Active Storage access to non-sensitive directories; enable file integrity monitoring; implement Web Application Firewall rules to block suspicious path traversal patterns; disable user-facing file upload features if not essential.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Threat Intel
1
1 source
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Affected Products (CPE)CVE.org

pkg:rubygems/activestorage
pkg:rubygems/activestorage
pkg:rubygems/activestorage

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed

References

Advisories & patches
PATCH https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c PATCH https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655 PATCH https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348 ADVISORY https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87 ADVISORY https://vuldb.com/vuln/352623 REF https://access.redhat.com/security/cve/CVE-2026-33195 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450546 REF https://github.com/advisories/GHSA-9xrj-h377-fr87 REF https://github.com/rails/rails/releases/tag/v7.2.3.1 REF https://github.com/rails/rails/releases/tag/v8.0.4.1 REF https://github.com/rails/rails/releases/tag/v8.1.2.1 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy