Path traversal in Ruby on Rails - CVE-2026-33195
Published: March 24, 2026
Vulnerability identifier: #VU124280
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33195
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in Active Storage DiskService. A remote attacker can send a specially crafted HTTP request and read, write or delete arbitrary files on the system.
Affected software
Ruby on Rails
Debian Linux
rails (Debian package)
Debian Linux
rails (Debian package)
How to mitigate CVE-2026-33195
Install updates from vendor's website.
Ruby on Rails - addressed in versions 7.2.3.1, 8.0.4.1, 8.1.2.1
rails (Debian package) - update to 2:7.2.2.2+dfsg-2~deb13u2
rails (Debian package) - update to 2:7.2.2.2+dfsg-2~deb13u2