CVE-2026-33202: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskServicedeleteprefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled inp...

CVE-2026-33202

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's "DiskServicedeleteprefixed" passes blob keys directly to "Dir.glob" without escaping glob metacharacters. If a blob key contains attacker-controlled...