SB20261007144 - Debian update for rails
Published: October 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-33168)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Action View tag helpers. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Incorrect Regular Expression (CVE-ID: CVE-2026-33169)
CWE-ID: CWE-185 - Incorrect Regular Expression
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions within number_to_delimited in Active Support. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
3) Cross-site scripting (CVE-ID: CVE-2026-33170)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within SafeBuffer#% in Active Support. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Expired pointer dereference (CVE-ID: CVE-2026-33173)
CWE-ID: CWE-825 - Expired pointer dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. A remote attacker can gain access to sensitive information on the target system.
5) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-33174)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to ucontrolled memory allocation in Active Storage proxy mode. A remote attacker can cause a denial of service (DoS) condition on the target system.
6) Resource exhaustion (CVE-ID: CVE-2026-33176)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in Active Support number helpers. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Path traversal (CVE-ID: CVE-2026-33195)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in Active Storage DiskService. A remote attacker can send a specially crafted HTTP request and read, write or delete arbitrary files on the system.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the glob injection in Active Storage DiskService. A remote attacker can delete unintended files from the storage directory.
9) Input validation error (CVE-ID: CVE-2026-33658)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Active Storage proxy mode. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
10) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-66066) Exploited
CWE-ID: CWE-1188 - Insecure Default Initialization of Resource
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and potentially execute arbitrary code.
The vulnerability exists due to initialization of a resource with an insecure default in Active Storage variant processing when processing a crafted uploaded file to generate an image variant. A remote attacker can upload a crafted file and cause a variant to be generated from it to disclose sensitive information and potentially execute arbitrary code.
Only applications using libvips for Active Storage image processing and allowing image uploads from untrusted users are vulnerable.
Remediation
Install update from vendor's website.