--- title: "Rails activestorage vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/rails/activestorage type: product description: "Rails activestorage has 9 published CVEs, 0 in CISA KEV and 2 with public exploits." updated: 2026-07-30 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Rails activestorage vulnerabilities Vendor: [Rails](https://radicalnotion.ai/vendor/rails) - **Published CVEs:** 9 - **In CISA KEV:** 0 - **With a public exploit:** 2 - **With a patch:** 9 - **Average CVSS:** 7.0 - **First CVE:** 2022-05-26 - **Latest CVE:** 2026-07-30 - **Ecosystems:** gem ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 3 | | High | 1 | | Medium | 4 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 2 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-74](https://radicalnotion.ai/cwe/cwe-74) | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 | | [CWE-1188](https://radicalnotion.ai/cwe/cwe-1188) | Initialization of a Resource with an Insecure Default | 1 | | [CWE-789](https://radicalnotion.ai/cwe/cwe-789) | Memory Allocation with Excessive Size Value | 1 | | [CWE-925](https://radicalnotion.ai/cwe/cwe-925) | Improper Verification of Intent by Broadcast Receiver | 1 | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2022 | 1 | | 2023 | 0 | | 2024 | 1 | | 2025 | 0 | | 2026 | 7 | ## Affected versions (top 29 of 42) | Version | Kind | CVEs | | --- | --- | --- | | \< 7.2.3.1 | exact | 5 | | \>= 8.0.0.beta1, \< 8.0.4.1 | exact | 4 | | \>= 8.1.0.beta1, \< 8.1.2.1 | exact | 4 | | \>= 8.0.0, \< 8.0.4.1 | exact | 1 | | \>= 8.1.0, \< 8.1.2.1 | exact | 1 | | \< 7.2.3.1 | range | 5 | | 8.0.0.beta1 \<= v \< 8.0.4.1 | range | 4 | | 8.1.0.beta1 \<= v \< 8.1.2.1 | range | 4 | | \< 7.2.3.2 | range | 1 | | 5.2 \<= v \< 5.\* | range | 1 | | 5.2.0 \<= v \< 5.2.6.3 | range | 1 | | 5.2.0 \<= v \< 6.1.7.7 | range | 1 | | 5.2.0 \<= v \< 7.1.5.2 | range | 1 | | 6.0.0 \<= v \< 6.0.4.7 | range | 1 | | 6.1.0 \<= v \< 6.1.4.7 | range | 1 | | 7.0 \<= v \< 7.1.5.2 | range | 1 | | 7.0.0 \<= v \< 7.0.2.3 | range | 1 | | 7.2.3.1 | patched | 5 | | 8.0.4.1 | patched | 5 | | 8.1.2.1 | patched | 5 | | 5.\* | patched | 1 | | 5.2.6.3 | patched | 1 | | 6.0.4.7 | patched | 1 | | 6.1.4.7 | patched | 1 | | 6.1.7.7 | patched | 1 | | 7.0.2.1 | patched | 1 | | 7.0.2.3 | patched | 1 | | 7.0.8.1 | patched | 1 | | 7.1.5.2 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-66066 | Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing | critical | 9.5 | No | Yes | Yes | | CVE-2026-33658 | Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests | low | 2.3 | No | No | Yes | | CVE-2026-33202 | Rails Active Storage has possible glob injection in its DiskService | medium | 6.6 | No | No | Yes | | CVE-2026-33195 | Rails Active Storage has possible Path Traversal in DiskService | high | 8.0 | No | No | Yes | | CVE-2026-33174 | Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests | medium | 6.6 | No | No | Yes | | CVE-2026-33173 | Rails Active Storage has possible content type bypass via metadata in direct uploads | medium | 5.3 | No | No | Yes | | CVE-2025-24293 | Active Storage allowed transformation methods that were potentially unsafe | critical | 9.2 | No | Yes | Yes | | CVE-2024-26144 | Possible Sensitive Session Information Leak in Active Storage | medium | 5.3 | No | No | Yes | | CVE-2022-21831 | Possible code injection vulnerability in Rails / Active Storage | critical | 9.8 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Rails activestorage have? Rails activestorage has 9 published CVE records since 2022. ### How many Rails activestorage CVEs are in CISA KEV? None of Rails activestorage's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Rails activestorage vulnerabilities? Yes — 2 of Rails activestorage's CVEs have a known public exploit. ### Which versions of Rails activestorage are affected? 42 distinct Rails activestorage versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Rails activestorage CVEs? Rails activestorage's CVEs most often map to these CWE weakness types: CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). ### How many critical Rails activestorage vulnerabilities are there? Rails activestorage has 3 critical and 1 high-severity CVEs. ### What is the average severity of Rails activestorage CVEs? The average CVSS base score across Rails activestorage's scored CVEs is 7.0. ## Other products from this vendor - [rails](https://radicalnotion.ai/vendor/rails/rails) (110 CVEs) - [actionpack](https://radicalnotion.ai/vendor/rails/actionpack) (46 CVEs) - [activerecord](https://radicalnotion.ai/vendor/rails/activerecord) (15 CVEs) - [rails-html-sanitizer](https://radicalnotion.ai/vendor/rails/rails-html-sanitizer) (15 CVEs) - [ActiveSupport](https://radicalnotion.ai/vendor/rails/activesupport) (13 CVEs) - [actionview](https://radicalnotion.ai/vendor/rails/actionview) (8 CVEs) - [https://github.com/rails/rails](https://radicalnotion.ai/vendor/rails/https-github-com-rails-rails) (3 CVEs) - [actionmailer](https://radicalnotion.ai/vendor/rails/actionmailer) (2 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/rails/activestorage). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.