Impact
Active Storage’s DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a malicious direct-upload client could set these flags.
Releases
The fixed releases are available at the normal locations.
- CVE-2026-33173
- GHSA-qcfx-2mfw-w4cg
Versions affected
- activestorage >= 8.1, < 8.1.2.1 (patched in 8.1.2.1)
- activestorage >= 8.0, < 8.0.4.1 (patched in 8.0.4.1)
- activestorage < 7.2.3.1 (patched in 7.2.3.1)