Executive brief
Active Record Tenanted, a library used for managing multi-tenant data in Ruby applications, contains a vulnerability in how it handles file storage paths. If an application allows users to influence file keys, an attacker could potentially read, write, or delete unauthorized files on the server. This could lead to data theft, data loss, or system instability.
Technical details
A path traversal vulnerability exists in ActiveRecord::Tenanted::Storage::DiskService#path_for due to insufficient validation of resolved filesystem paths. The component fails to ensure that the resulting path remains within the designated storage root directory. If an attacker can provide a blob key containing traversal sequences like '../', they can potentially access, modify, or delete arbitrary files on the host filesystem. This exploit requires the application to pass untrusted user input as blob keys, which are typically expected to be trusted strings. The issue is fixed in version 0.7.0.
Affected products
- Basecamp activerecord-tenanted < 0.7.0
Timeline
- 2026-06-08: disclosed: Initial disclosure by flavorjones
- 2026-06-08: patched: Version 0.7.0 released
- 2026-07-29: advisory: GitHub Advisory published