En bref
- CVE-2026-33173 est une vulnérabilité MOYENNE (CVSS 5.3) touchant activestorage, rails (rubyonrails).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.40%, plus élevée que 34.0% des vulnérabilités.
- Correctif : mettre à jour vers 8.0.4.1, 8.1.2.1, 7.2.3.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| activestorage RubyGems | ≥ 8.0.0.beta1, < 8.0.4.1≥ 8.1.0.beta1, < 8.1.2.1< 7.2.3.1
| 8.0.4.18.1.2.17.2.3.1
|
| rails | ≥ 8.0.0, < 8.0.4.1≥ 8.1.0, < 8.1.2.1< 7.2.3.1
| 8.0.4.18.1.2.17.2.3.1
|
Description
Impact
Active Storage's DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a malicious direct-upload client could set these flags.
Releases
The fixed releases are available at the normal locations.
Credit
This was responsible reported by Hackerone researcher pwnie
NVD description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free