Rails activestorage vulnerabilities

CVEs per yearBy the year they were published

1. 20265
2. 20261

Newest CVEs

• CVE-2026-33658

  Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

  rails · activestorage

  Low2.3
• CVE-2026-33202

  Rails Active Storage has possible glob injection in its DiskService

  rails · activestorage

  Medium6.6
• CVE-2026-33195

  Rails Active Storage has possible Path Traversal in DiskService

  rails · activestorage

  High8.0
• CVE-2026-33174

  Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

  rails · activestorage

  Medium6.6
• CVE-2026-33173

  Rails Active Storage has possible content type bypass via metadata in direct uploads

  rails · activestorage

  Medium5.3
• CVE-2025-24293

  # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation…

  Rails · activestorage

  Critical9.2