CVE-2026-33173
Rails Active Storage has possible content type bypass via metadata in direct uploads
Using activestorage by rails?
Get instant alerts when new vulnerabilities affect activestorage - before attackers find them.
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
- https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
- https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
- https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
References (7)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.