CVE detail
CVE-2026-33195
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 24.0 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
10 source links · newest first
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMar 24, 2026, 12:16 AM - https://bugzilla.redhat.com/show_bug.cgi?id=2450546bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 24, 2026, 12:16 AM - https://access.redhat.com/security/cve/CVE-2026-33195access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 24, 2026, 12:16 AM No excerpt available.
Exploitgithub.comMar 24, 2026, 12:16 AMNo excerpt available.
Exploitgithub.comMar 24, 2026, 12:16 AMNo excerpt available.
Exploitgithub.comMar 24, 2026, 12:16 AMNo excerpt available.
Exploitgithub.comMar 24, 2026, 12:16 AMNo excerpt available.
Exploitgithub.comMar 24, 2026, 12:16 AMNo excerpt available.
Exploitgithub.comMar 24, 2026, 12:16 AMNo excerpt available.
Exploitgithub.comMar 24, 2026, 12:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2019-5418CVSS 7.5 · High
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitra…
- CVE-2016-2097CVSS 5.3 · Medium
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an applicat…
- CVE-2016-0752CVSS 7.5 · High
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remot…
- CVE-2014-7829CVSS 5.0 · Medium
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8…
- CVE-2014-7818CVSS 4.3 · Medium
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7…
- CVE-2014-0130CVSS 7.5 · High
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x…