CVE-2026-33173
Fixed in a distro release EPSS <1%CVSS 5.3
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Products: Rails activestorage
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activestorage | 8.1.2.1 |
| RubyGems | activestorage | 8.0.4.1 |
| RubyGems | activestorage | 7.2.3.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | 18.10.3-r1 |
| Chainguard | gitlab-rails-ce-18.2 | no fix |
| Chainguard | gitlab-rails-ce-18.3 | no fix |
| Chainguard | gitlab-rails-ce-18.4 | no fix |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | 18.8.11-r4 |
| Chainguard | gitlab-rails-ce-18.9 | 18.9.5-r0 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.3-r0 |
| Chainguard | gitlab-rails-ce-fips-18.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.5-r0 |
| Chainguard | ruby3.2-rails-7.1 | no fix |
| Chainguard | ruby3.2-rails-8.1 | 8.1.3-r0 |
| Chainguard | ruby3.3-rails-7.1 | no fix |
| Chainguard | ruby3.4-rails-7.1 | no fix |
| Chainguard | ruby3.4-rails-8.0 | 8.0.5-r0 |
| Chainguard | ruby4.0-rails-7.1 | no fix |
| Debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| Debian 13 | rails | 2:7.2.2.2+dfsg-2~deb13u2 |
| Debian 14 | rails | 2:7.2.3.1+dfsg-1 |
| Ubuntu 24.04 LTS | rails | no fix |
| Ubuntu 25.10 | rails | no fix |
| Ubuntu 26.04 LTS | rails | no fix |
| Ubuntu 26.10 | rails | no fix |
| Ubuntu Pro 16.04 LTS | rails | no fix |
| Ubuntu Pro 18.04 LTS | rails | no fix |
| Ubuntu Pro 20.04 LTS | rails | no fix |
| Ubuntu Pro 22.04 LTS | rails | no fix |
| Wolfi | ruby3.2-rails-8.1 | 8.1.3-r0 |