Skip to content

Commit 3594786

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-73f9-jhhh-hr5m GHSA-9xrj-h377-fr87
1 parent 4a4a0c3 commit 3594786

File tree

2 files changed

+238
-0
lines changed

2 files changed

+238
-0
lines changed

‎advisories/github-reviewed/2026/03/GHSA-73f9-jhhh-hr5m/GHSA-73f9-jhhh-hr5m.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-73f9-jhhh-hr5m",
4+
"modified": "2026-03-23T21:18:56Z",
5+
"published": "2026-03-23T21:18:56Z",
6+
"aliases": [
7+
"CVE-2026-33202"
8+
],
9+
"summary": "Rails Active Storage has possible glob injection in its DiskService",
10+
"details": "### Impact\nActive Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.\n\n### Releases\nThe fixed releases are available at the normal locations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "activestorage"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.1.0.beta1"
29+
},
30+
{
31+
"fixed": "8.1.2.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "RubyGems",
40+
"name": "activestorage"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.0.0.beta1"
48+
},
49+
{
50+
"fixed": "8.0.4.1"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "RubyGems",
59+
"name": "activestorage"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "7.2.3.1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/rails/rails"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-74"
113+
],
114+
"severity": "MODERATE",
115+
"github_reviewed": true,
116+
"github_reviewed_at": "2026-03-23T21:18:56Z",
117+
"nvd_published_at": null
118+
}
119+
}

‎advisories/github-reviewed/2026/03/GHSA-9xrj-h377-fr87/GHSA-9xrj-h377-fr87.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9xrj-h377-fr87",
4+
"modified": "2026-03-23T21:17:19Z",
5+
"published": "2026-03-23T21:17:19Z",
6+
"aliases": [
7+
"CVE-2026-33195"
8+
],
9+
"summary": "Rails Active Storage has possible Path Traversal in DiskService",
10+
"details": "### Impact\nActive Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.\n\n### Releases\nThe fixed releases are available at the normal locations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "activestorage"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.1.0.beta1"
29+
},
30+
{
31+
"fixed": "8.1.2.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "RubyGems",
40+
"name": "activestorage"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.0.0.beta1"
48+
},
49+
{
50+
"fixed": "8.0.4.1"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "RubyGems",
59+
"name": "activestorage"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "7.2.3.1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/rails/rails"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-22"
113+
],
114+
"severity": "HIGH",
115+
"github_reviewed": true,
116+
"github_reviewed_at": "2026-03-23T21:17:19Z",
117+
"nvd_published_at": null
118+
}
119+
}

0 commit comments

Comments
 (0)