Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-33173

Summary
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
Published At-23 Mar, 2026 | 23:21
Updated At-24 Mar, 2026 | 15:12
Rejected At-
Credits

Rails Active Storage has possible content type bypass via metadata in direct uploads

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:GitHub_M
Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa
Published At:23 Mar, 2026 | 23:21
Updated At:24 Mar, 2026 | 15:12
Rejected At:
▼CVE Numbering Authority (CNA)
Rails Active Storage has possible content type bypass via metadata in direct uploads

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected Products
Vendor
Ruby on Railsrails
Product
activestorage
Versions
Affected
  • >= 8.1.0.beta1, < 8.1.2.1
  • >= 8.0.0.beta1, < 8.0.4.1
  • < 7.2.3.1
Problem Types
TypeCWE IDDescription
CWECWE-925CWE-925: Improper Verification of Intent by Broadcast Receiver
Type: CWE
CWE ID: CWE-925
Description: CWE-925: Improper Verification of Intent by Broadcast Receiver
Metrics
VersionBase scoreBase severityVector
4.05.3MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Version: 4.0
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
x_refsource_CONFIRM
https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
x_refsource_MISC
https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
x_refsource_MISC
https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
x_refsource_MISC
https://github.com/rails/rails/releases/tag/v7.2.3.1
x_refsource_MISC
https://github.com/rails/rails/releases/tag/v8.0.4.1
x_refsource_MISC
https://github.com/rails/rails/releases/tag/v8.1.2.1
x_refsource_MISC
Hyperlink: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
Resource:
x_refsource_MISC
Hyperlink: https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
Resource:
x_refsource_MISC
Hyperlink: https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
Resource:
x_refsource_MISC
Hyperlink: https://github.com/rails/rails/releases/tag/v7.2.3.1
Resource:
x_refsource_MISC
Hyperlink: https://github.com/rails/rails/releases/tag/v8.0.4.1
Resource:
x_refsource_MISC
Hyperlink: https://github.com/rails/rails/releases/tag/v8.1.2.1
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-advisories@github.com
Published At:24 Mar, 2026 | 00:16
Updated At:24 Mar, 2026 | 17:56

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.05.3MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.15.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Type: Secondary
Version: 4.0
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CPE Matches
Ruby on Rails
rubyonrails
>>rails>>Versions before 7.2.3.1(exclusive)
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
Ruby on Rails
rubyonrails
>>rails>>Versions from 8.0.0(inclusive) to 8.0.4.1(exclusive)
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
Ruby on Rails
rubyonrails
>>rails>>Versions from 8.1.0(inclusive) to 8.1.2.1(exclusive)
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-925Primarysecurity-advisories@github.com
CWE ID: CWE-925
Type: Primary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53security-advisories@github.com
Patch
https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3esecurity-advisories@github.com
Patch
https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0security-advisories@github.com
Patch
https://github.com/rails/rails/releases/tag/v7.2.3.1security-advisories@github.com
Release Notes
https://github.com/rails/rails/releases/tag/v8.0.4.1security-advisories@github.com
Release Notes
https://github.com/rails/rails/releases/tag/v8.1.2.1security-advisories@github.com
Release Notes
https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cgsecurity-advisories@github.com
Vendor Advisory
Hyperlink: https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/rails/rails/releases/tag/v7.2.3.1
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/rails/rails/releases/tag/v8.0.4.1
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/rails/rails/releases/tag/v8.1.2.1
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
Source: security-advisories@github.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

2Records found
CVE-2026-33170
Matching Score-8
Assigner-GitHub, Inc.
ShareView Details
Matching Score-8
Assigner-GitHub, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.33% / 25.16%
||
7 Day CHG~0.00%
Published-23 Mar, 2026 | 23:09
Updated-25 Mar, 2026 | 19:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Action-Not Available
Vendor-Ruby on Rails
Product-railsactivesupport
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-0753
Matching Score-8
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-8
Assigner-Red Hat, Inc.
CVSS Score-5.3||MEDIUM
EPSS-7.16% / 93.61%
||
7 Day CHG~0.00%
Published-16 Feb, 2016 | 02:00
Updated-06 May, 2026 | 22:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Action-Not Available
Vendor-n/aopenSUSERuby on RailsDebian GNU/LinuxFedora Project
Product-leapdebian_linuxrailsfedoran/a
Details not found