| Package | Affected versions | Patched versions |
|---|---|---|
| activestorage | ≥ 8.0.0.beta1, < 8.0.4.1≥ 8.1.0.beta1, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
| rails | ≥ 8.0.0, < 8.0.4.1≥ 8.1.0, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
Active Storage's DiskService#delete_prefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.
The fixed releases are available at the normal locations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free