CVE-2026-33195 Rubyonrails — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	8.0 (HIGH)
Affected Versions	8.0.0 — 8.1.2.1
Fixed In	7.2.3.1
Type	CWE-22 (Path Traversal)
Vendor	Rubyonrails
Public PoC	No

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server.

Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Attack Requirements

None

No additional conditions

Privileges Required

None

No privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

None

No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-22 Path Traversal

Vulnerable Products 3

Configuration	From (including)	Up to (excluding)
Rubyonrails Rails cpe:2.3:a:rubyonrails:rails::::::::	—	`7.2.3.1`
Rubyonrails Rails cpe:2.3:a:rubyonrails:rails::::::::	`8.0.0`	`8.0.4.1`
Rubyonrails Rails cpe:2.3:a:rubyonrails:rails::::::::	`8.1.0`	`8.1.2.1`