{
  "cveId": "CVE-2026-33173",
  "url": "https://patchblox.com/security/cve/CVE-2026-33173",
  "summary": "CVE-2026-33173 is fixed in rails on 1 platform, first by DEBIAN-CVE-2026-33173, released March 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "rails: Active Storage allows users to attach cloud and local files in Rails applications",
  "description": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, \u0060DirectUploadsController\u0060 accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like \u0060identified\u0060 and \u0060analyzed\u0060 are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe \u0060content_type\u0060, bypassing any validations that rely on Active Storage\u0027s automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.",
  "published": "2026-03-24T00:16:28Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss": 0.00397,
  "epssPercentile": 0.34212,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2:6.1.7.10\u002Bdfsg-1~deb12u3",
      "fix": "DEBIAN-CVE-2026-33173",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33173",
      "released": "2026-03-24T00:16:28Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2:7.2.2.2\u002Bdfsg-2~deb13u2",
      "fix": "DEBIAN-CVE-2026-33173",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33173",
      "released": "2026-03-24T00:16:28Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 14",
      "fixedVersion": "2:7.2.3.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-33173",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33173",
      "released": "2026-03-24T00:16:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}