7 known security vulnerabilities

  • criticalGHSA-r4mg-4433-c7g3(CVE-2025-24293)

    Active Storage allowed transformation methods that were potentially unsafe

Show 6 more vulnerabilities
1 critical1 high3 moderate1 low
  • criticalGHSA-xr9x-r78c-5hrm(CVE-2026-66066)

    Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

  • highGHSA-9xrj-h377-fr87(CVE-2026-33195)

    Rails Active Storage has possible Path Traversal in DiskService

  • moderateGHSA-73f9-jhhh-hr5m(CVE-2026-33202)

    Rails Active Storage has possible glob injection in its DiskService

  • moderateGHSA-qcfx-2mfw-w4cg(CVE-2026-33173)

    Rails Active Storage has possible content type bypass via metadata in direct uploads

  • moderateGHSA-r46p-8f7g-vvvg(CVE-2026-33174)

    Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

  • lowGHSA-p9fm-f462-ggrg(CVE-2026-33658)

    Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Attach cloud and local files in Rails applications.

Required Ruby Version

>= 2.7.0

Authors

David Heinemeier Hansson

Versions

  1. 8.1.4

    1. source

      1. 8.1.4 source September 24, 2026 (72 KB)
  2. 8.1.3.1

    1. source

      1. 8.1.3.1 source July 29, 2026 (70 KB)
  3. 8.1.3

    1. source

      1. 8.1.3 source March 24, 2026 (68.5 KB)
  4. 8.1.2.1

    1. source

      1. 8.1.2.1 source March 23, 2026 (68.5 KB)
  5. 8.1.2

    1. source

      1. 8.1.2 source January 08, 2026 (67 KB)
  6. 7.0.10

    1. source

      1. 7.0.10 source October 28, 2025 (65 KB)
Show all versions (188 total)

Pushed by

GitHub

SHA 256 checksum

Provenance

Built and signed on

GitHub Actions

Build summary

Source Commit

rails/rails@f4321f7

← Previous version Next version →