Executive brief
Active Storage is a component of the Ruby on Rails framework used to manage file uploads and storage. A security flaw allows attackers to bypass directory restrictions if an application uses untrusted user input to name or retrieve files. This could allow an unauthorized person to read, modify, or delete sensitive files on the server, potentially leading to a full system compromise or data breach.
Technical details
A path traversal vulnerability exists in Active Storage's DiskService#path_for method. The component fails to validate that a resolved filesystem path remains within the designated storage root directory. If an application passes user-controlled input as a 'blob key', an attacker can use traversal sequences like '../' to escape the storage directory. This enables arbitrary file read, write, or delete operations on the host server. The issue is fixed in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 by introducing strict validation and raising an InvalidKeyError for dot segments or paths outside the root.
Affected products
- Ruby on Rails Active Storage (Rails) < 7.2.3.1, >= 8.0.0.beta1 < 8.0.4.1, >= 8.1.0.beta1 < 8.1.2.1
Timeline
- 2026-03-24: disclosed
- 2026-03-24: advisory
- 2026-03-23: patched
References
- https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
- https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655
- https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1
- https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87