CVE-2026-33202 is a critical (CVSS 9.1) flaw in Active Storage, the file attachment layer in Ruby on Rails. DiskService#delete_prefixed passes blob keys to Dir.glob without escaping glob characters, so unintended files may be deleted. Upgrade to Rails 8.1.2.1, 8.0.4.1 or 7.2.3.1.
What's affected
Rails applications that use Active Storage with the disk service, on versions before 8.1.2.1, 8.0.4.1 and 7.2.3.1. The fixed releases are 8.1.2.1, 8.0.4.1 and 7.2.3.1, one per supported branch.
The record says the risk applies if a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters. Default generated keys are not described as affected, but the NVD score assumes network reach, so treat any app with custom key logic as a priority.
How to check if you're exposed
Find the Rails version your app resolves:
bundle list | grep -E "rails |activestorage"
Then check config/storage.yml for a service of type Disk. Search your code for custom key: values passed when attaching or creating blobs, and for places where user input could end up in a key.
Paste your lockfile into the free in-browser dependency scan to see which versions you resolve, including transitive ones. Gold also lists this CVE on its directory page.
What to do now
- Upgrade to Rails 8.1.2.1, 8.0.4.1 or 7.2.3.1, whichever matches your branch, and run
bundle update rails. - Deploy and confirm with
bundle listthat activestorage shows the fixed version. - Audit any custom blob key generation. Keys should never include raw user input.
- Back up the storage directory before you roll out, so an unexpected deletion can be recovered.
Why it matters
The weakness class is CWE-74, improper neutralization of special elements in output used by a downstream component. Here the downstream component is Dir.glob, which treats characters such as the asterisk and brackets as patterns rather than literal text. A key built from those characters can match more files than the code meant to remove.
The impact in the vector is integrity and availability, not data theft. A file deleted from the storage directory is gone for your users, so it is worth patching even where exploitation looks unlikely. The record does not flag this CVE as known exploited.
Quick check
Is my app safe if I only use S3 or another cloud service?
The record names the disk service method DiskService#delete_prefixed. Cloud services are not mentioned, but you should still upgrade, since the fix ships with the Rails release.
Sources
Last reviewed: 19 October 2026.
