Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

activestorage

11 known vulnerabilities (2 critical, 1 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 2 critical, 1 high, 4 medium, 1 low
Registry
RubyGems

Advisories 11

  • CVE-2026-66066Critical 9.5

    Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

    Affected: fixed in 7.2.3.2; from 8.0.0.beta1, fixed in 8.0.5.1; from 8.1.0.beta1, fixed in 8.1.3.1.

  • Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

    Affected: from 8.1.0, fixed in 8.1.2.1; from 8.0.0, fixed in 8.0.4.1; fixed in 7.2.3.1.

  • CVE-2026-33202Medium 6.6

    Rails Active Storage has possible glob injection in its DiskService

    Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.

  • Rails Active Storage has possible Path Traversal in DiskService

    Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.

  • CVE-2026-33174Medium 6.6

    Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

    Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.

  • CVE-2026-33173Medium 5.3

    Rails Active Storage has possible content type bypass via metadata in direct uploads

    Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.

  • CVE-2025-24293Critical 9.2

    # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image…

    Affected: from 8.0, fixed in 8.0.2.1; from 7.2, fixed in 7.2.2.2; from 5.2.0, fixed in 7.1.5.2.

  • CVE-2024-26144Medium 5.3

    Possible Sensitive Session Information Leak in Active Storage

    Affected: from 5.2.0, fixed in 6.1.7.7; from 7.0.0, fixed in 7.0.8.1.

  • A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing…

    Affected: from 5.2.0, fixed in 5.2.6.3; from 6.0.0, fixed in 6.0.4.7; from 6.1.0, fixed in 6.1.4.7; from 7.0.0, fixed in 7.0.2.3.

  • A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter…

    Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1.

  • A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the…

    Affected: from 5.2.0, fixed in 5.2.1.1.