kritik
CVE-2026-33202
rails: Active Storage: Unintended file deletion via crafted blob keys
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA6.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Red Hat6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (orta), Red Hat (orta).
Açıklama
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | gitlab-rails-ce-18.10, gitlab-rails-ce-18.8, gitlab-rails-ce-18.9 ve 4 tane daha | 18.10.3-r1 ve 5 tane daha |
| debian 11 | rails | düzeltme belirtilmemiş |
| debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| debian 13 | rails | 2:7.2.2.2+dfsg-2~deb13u2 |
| debian 14 | rails | 2:7.2.3.1+dfsg-1 |
| echo | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| rapidfort debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rapidfort debian 13 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rubygems::GitHub Security Advisory RubyGems | activestorage | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
| rubygems::Ruby Advisory Database | activestorage | ~> 7.2.3, >= 7.2.3.1, ~> 8.0.4, >= 8.0.4.1, >= 8.1.2.1 |
| wolfi | ruby3.2-rails-8.1 | 8.1.3-r0 |
11 kaynaktaki 17 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | gitlab-rails-ce-18.10 | 18.10.3-r1 |
| chainguard | gitlab-rails-ce-18.8 | 18.8.11-r4 |
| chainguard | gitlab-rails-ce-18.9 | 18.9.5-r0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.3-r0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.5-r0 |
| chainguard | ruby3.2-rails-8.1 | 8.1.3-r0 |
| chainguard | ruby3.4-rails-8.0 | 8.0.5-r0 |
| debian 11 | rails | düzeltme belirtilmemiş |
| debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| debian 13 | rails | 2:7.2.2.2+dfsg-2~deb13u2 |
| debian 14 | rails | 2:7.2.3.1+dfsg-1 |
| echo | rails | 2:6.1.7.10+dfsg-1~deb12u3 |
| rapidfort debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rapidfort debian 13 | rails | 2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.1+dfsg-1 |
| rubygems::GitHub Security Advisory RubyGems | activestorage | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
| rubygems::Ruby Advisory Database | activestorage | ~> 7.2.3, >= 7.2.3.1, ~> 8.0.4, >= 8.0.4.1, >= 8.1.2.1 |
| wolfi | ruby3.2-rails-8.1 | 8.1.3-r0 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2026-33202
- https://github.com/rails/rails
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
- https://github.com/rails/rails/releases/tag/v7.2.3.1
- https://github.com/rails/rails/releases/tag/v8.0.4.1
- https://github.com/rails/rails/releases/tag/v8.1.2.1