CVE-2026-33195: Ruby on Rails Active Storage path traversal in DiskService

CVE-2026-33195 · Severity: critical · CVSS 9.8 · Published 2026-03-24

Active Storage is a component of the Ruby on Rails framework used to manage file uploads and storage. A security flaw allows attackers to bypass directory restrictions if an application uses untrusted user input to name or retrieve files. This could allow an unauthorized person to read, modify, or delete sensitive files on the server, potentially leading to a full system compromise or data breach.

Technologies: Ruby on Rails Active Storage, activestorage (RubyGems). Vendors: Ruby on Rails, RubyGems.

Quick answers

Is CVE-2026-33195 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33195 being exploited in the wild.
How severe is CVE-2026-33195?
Critical severity, with a CVSS score of 9.8, published 24 March 2026.
Which products and versions are affected?
Ruby on Rails Active Storage < 7.2.3.1, >= 8.0.0.beta1 < 8.0.4.1, >= 8.1.0.beta1 < 8.1.2.1; activestorage (RubyGems) ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.2.1.
Is there a fix for CVE-2026-33195?
Yes. activestorage (RubyGems): upgrade to 8.1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33195 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33195?
Check whether you run Ruby on Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • activestorage (RubyGems): upgrade to 8.1.2.1 or later
    bundle update activestorage

Technical details

A path traversal vulnerability exists in Active Storage's DiskService#path_for method. The component fails to validate that a resolved filesystem path remains within the designated storage root directory. If an application passes user-controlled input as a 'blob key', an attacker can use traversal sequences like '../' to escape the storage directory. This enables arbitrary file read, write, or delete operations on the host server. The issue is fixed in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 by introducing strict validation and raising an InvalidKeyError for dot segments or paths outside the root.

Affected products

  • Ruby on Rails Active Storage (Rails) < 7.2.3.1, >= 8.0.0.beta1 < 8.0.4.1, >= 8.1.0.beta1 < 8.1.2.1

Identifiers

  • CVE-2026-33195
  • GHSA-9xrj-h377-fr87

Timeline

  • 2026-03-24: disclosed
  • 2026-03-24: advisory
  • 2026-03-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.