Executive brief
Active Storage, a component of the Ruby on Rails framework used for managing file uploads, contains a flaw in how it handles file deletion on local disk storage. If an application uses custom-generated file names or allows user input to influence file keys, an attacker could potentially delete unintended files from the server's storage directory. This could lead to data loss or disruption of service by removing critical application assets.
Technical details
A glob injection vulnerability exists in `ActiveStorage::Service::DiskService#delete_prefixed`. The method passes blob keys directly to Ruby's `Dir.glob` without escaping metacharacters (such as `*` or `?`). If an attacker can control or influence the blob keys—either through custom key generation logic or direct input—they can inject glob patterns to match and delete files outside of the intended scope within the storage directory. This is primarily a risk when using the `DiskService` for local file storage. Patches have been released in versions 7.2.3.1, 8.0.4.1, and 8.1.2.1 which implement proper escaping of glob metacharacters.
Affected products
- Ruby on Rails activestorage < 7.2.3.1, >= 8.0.0.beta1, < 8.0.4.1, >= 8.1.0.beta1, < 8.1.2.1
Timeline
- 2026-03-23: disclosed
- 2026-03-23: patched
- 2026-03-23: advisory
References
- https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1