crítica
CVE-2026-33202
rails: Active Storage: Unintended file deletion via crafted blob keys
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA6.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Red Hat6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media), Red Hat (media).
Descripción
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| chainguard | gitlab-rails-ce-18.10, gitlab-rails-ce-18.8, gitlab-rails-ce-18.9 y 4 más | 18.10.3-r1 y 5 más |
| debian 11 | rails | sin corrección indicada |
| debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| debian 13 | rails | 2:7.2.2.2+dfsg-2~deb13u2 |
| debian 14 | rails | 2:7.2.3.1+dfsg-1 |
| echo | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| rapidfort debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rapidfort debian 13 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rubygems::GitHub Security Advisory RubyGems | activestorage | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
| rubygems::Ruby Advisory Database | activestorage | ~> 7.2.3, >= 7.2.3.1, ~> 8.0.4, >= 8.0.4.1, >= 8.1.2.1 |
| wolfi | ruby3.2-rails-8.1 | 8.1.3-r0 |
Mostrar las 17 entradas de 11 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| chainguard | gitlab-rails-ce-18.10 | 18.10.3-r1 |
| chainguard | gitlab-rails-ce-18.8 | 18.8.11-r4 |
| chainguard | gitlab-rails-ce-18.9 | 18.9.5-r0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.3-r0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.5-r0 |
| chainguard | ruby3.2-rails-8.1 | 8.1.3-r0 |
| chainguard | ruby3.4-rails-8.0 | 8.0.5-r0 |
| debian 11 | rails | sin corrección indicada |
| debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| debian 13 | rails | 2:7.2.2.2+dfsg-2~deb13u2 |
| debian 14 | rails | 2:7.2.3.1+dfsg-1 |
| echo | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| rapidfort debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rapidfort debian 13 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rubygems::GitHub Security Advisory RubyGems | activestorage | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
| rubygems::Ruby Advisory Database | activestorage | ~> 7.2.3, >= 7.2.3.1, ~> 8.0.4, >= 8.0.4.1, >= 8.1.2.1 |
| wolfi | ruby3.2-rails-8.1 | 8.1.3-r0 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-33202
- https://github.com/rails/rails
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1