RubyGems Package Vulnerabilities
Vulnerabilities associated with activestorage.
Packages
Clear package- actionpack63 vulnerabilities
- nokogiri59 vulnerabilities
- rack50 vulnerabilities
- rubygems-update25 vulnerabilities
- activerecord23 vulnerabilities
- puppet23 vulnerabilities
- activesupport17 vulnerabilities
- camaleon_cms15 vulnerabilities
- publify_core15 vulnerabilities
- rails-html-sanitizer15 vulnerabilities
- passenger14 vulnerabilities
- puma14 vulnerabilities
- actionview13 vulnerabilities
- decidim13 vulnerabilities
- fat_free_crm12 vulnerabilities
- activestorage11 vulnerabilities
- loofah11 vulnerabilities
- oj11 vulnerabilities
- rails11 vulnerabilities
- net-imap10 vulnerabilities
- ruby-saml10 vulnerabilities
- decidim-core9 vulnerabilities
- jquery-rails9 vulnerabilities
- openc39 vulnerabilities
- avo8 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-66066CRITICAL | Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingAction Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including… CWE-1188Jul 30, 2026 | CVSS9.5v4.0 | EPSS1.77% | PoCs7 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch. CWE-770Mar 26, 2026 | CVSS2.3v4.0 | EPSS0.434% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-33202MEDIUM | Rails Active Storage has possible glob injection in its DiskServiceActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch. CWE-74Mar 23, 2026 | CVSS6.6v4.0 | EPSS0.646% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33195HIGH | Rails Active Storage has possible Path Traversal in DiskServiceActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing … CWE-22Mar 23, 2026 | CVSS8.0v4.0 | EPSS0.567% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33174MEDIUM | Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Vers… CWE-789Mar 23, 2026 | CVSS6.6v4.0 | EPSS0.61% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33173MEDIUM | Rails Active Storage has possible content type bypass via metadata in direct uploadsActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypass… CWE-925Mar 23, 2026 | CVSS5.3v4.0 | EPSS0.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-24293CRITICAL | Active Storage allowed transformation methods that were potentially unsafe# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. Impact ------ This vulnerability imp… | CVSS9.2v4.0 | EPSS2.39% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-26144MEDIUM | Possible Sensitive Session Information Leak in Active StorageRails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7. CWE-200Feb 27, 2024 | CVSS5.3v3.1 | EPSS1.13% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-21831CRITICAL | Possible code injection vulnerability in Rails / Active StorageA code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments. CWE-94May 26, 2022 | CVSS9.8v3.1 | EPSS3.03% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-8162HIGH | Circumvention of file size limits in ActiveStorageA client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits. | CVSS7.5v3.1 | EPSS3.03% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-16477MEDIUM | Exposure of Sensitive Information to an Unauthorized Actor in activestorageA bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1. CWE-200Nov 30, 2018 | CVSS6.5v3.0 | EPSS1.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |