Impact
Active Storage’s DiskService#delete_prefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.
Releases
The fixed releases are available at the normal locations.
- CVE-2026-33202
- GHSA-73f9-jhhh-hr5m
Versions affected
- activestorage >= 8.1, < 8.1.2.1 (patched in 8.1.2.1)
- activestorage >= 8.0, < 8.0.4.1 (patched in 8.0.4.1)
- activestorage < 7.2.3.1 (patched in 7.2.3.1)