Vulnerability Intelligence Report
Rails Active Storage has possible content type bypass via metadata in direct uploads
CVE-2026-33173
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
No Active Exploit Signals
CVSS Base Score
5.3
MEDIUM
EPSS Probability:0.39%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-925 ↗CWE-925: Improper Verification of Intent by Broadcast Receiver
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| rails | activestorage | >= 8.1.0.beta1, < 8.1.2.1 (affected), >= 8.0.0.beta1, < 8.0.4.1 (affected), < 7.2.3.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.390%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2026-03-17T22:16:36 |
| Published | 2026-03-23T23:21:29 |
| Last Updated | 2026-03-24T15:12:50 |
Community Chatter & Buzz