CVE-2026-33195 is a critical (CVSS 9.8) path traversal in Rails Active Storage. DiskService#path_for does not confirm the resolved path stays inside the storage root. Upgrade to Rails 8.1.2.1, 8.0.4.1 or 7.2.3.1, and never use user input as a blob key.
What's affected
Rails releases before 8.1.2.1, 8.0.4.1 and 7.2.3.1 using the Active Storage disk service. The patched versions are 8.1.2.1, 8.0.4.1 and 7.2.3.1.
Blob keys are meant to be trusted strings. The record says only applications that pass user input as keys are affected, but if yours does, an attacker could read, write or delete arbitrary files on the server.
How to check if you're exposed
Check your Rails version:
bundle exec rails -v
bundle list | grep activestorage
Then check config/storage.yml for a service of type Disk, and search your code for places that build or accept blob keys from request parameters.
What to do now
- Upgrade Rails to 8.1.2.1, 8.0.4.1 or 7.2.3.1 and redeploy.
- Never accept blob keys from users. Let Active Storage generate them.
- If you cannot upgrade yet, validate any key that touches storage and reject any containing parent directory segments.
- Run the file system under a least privilege account so a bug here cannot reach sensitive paths.
Why it matters
The weakness is CWE-22. The disk service joins a blob key onto the storage root without checking the result. A key with traversal sequences can therefore point outside that root.
The impact covers reading, writing and deleting files, which is why the scoring is high even though it depends on how an app handles keys. The record does not mark this CVE as listed in CISA KEV. A lockfile check across all your Rails apps is the quickest way to find the ones that need the update.
Try it yourself
Click through it at your own pace, or open it full screen.
You can also paste your Gemfile.lock into the free in-browser dependency scan.
Quick check
Does this affect apps using S3 or other cloud storage?
The record names the DiskService, so cloud services are not the described path. Confirm in your own storage.yml which service you use.
Sources
Last reviewed: 19 October 2026.
