GHSA-qcfx-2mfw-w4cg CVE-2026-33173
Rails Active Storage has possible content type bypass via metadata in direct uploads
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.40%
- Chance of exploitation in the next 30 days. Higher than 33.97% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-925 Improper Verification of Intent by Broadcast Receiver
- Fix
8.1.2.1- Upgrade activestorage to this version or later
Description
Impact
Active Storage's DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a malicious direct-upload client could set these flags.
Releases
The fixed releases are available at the normal locations.
Credit
This was responsible reported by Hackerone researcher pwnie
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| activestorage | >= 8.1.0.beta1, < 8.1.2.1 |
8.1.2.1 |
| activestorage | >= 8.0.0.beta1, < 8.0.4.1 |
8.0.4.1 |
| activestorage | < 7.2.3.1 |
7.2.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
activestorage RubyGems → 8.1.2.1
- bundler
bundle update activestorage # Gemfile: gem "activestorage", ">= 8.1.2.1"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-925: Improper Verification of Intent by Broadcast Receiver
The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
How to prevent it
- Architecture and Design: Before acting on the Intent, check the Intent Action to make sure it matches the expected System action.
References
Advisories
Packages
Other links
- github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
- github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
- github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
- github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
- github.com/rails/rails/releases/tag/v7.2.3.1
- github.com/rails/rails/releases/tag/v8.0.4.1
- github.com/rails/rails/releases/tag/v8.1.2.1
- github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-331…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | Critical | Also affects activestorage |
| GHSA-p9fm-f462-ggrg Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests | Medium | Also affects activestorage |
| GHSA-73f9-jhhh-hr5m Rails Active Storage has possible glob injection in its DiskService | Critical | Also affects activestorage |
| GHSA-9xrj-h377-fr87 Rails Active Storage has possible Path Traversal in DiskService | Critical | Also affects activestorage |
| GHSA-r46p-8f7g-vvvg Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests | High | Also affects activestorage |
| GHSA-r4mg-4433-c7g3 Active Storage allowed transformation methods that were potentially unsafe | High | Also affects activestorage |
| GHSA-8h22-8cf7-hq6g Rails has possible Sensitive Session Information Leak in Active Storage | Medium | Also affects activestorage |
| GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage | Critical | Also affects activestorage |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor