Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-a6z9-5n6k-2kak
Vulnerability ID VCID-a6z9-5n6k-2kak
Aliases CVE-2026-33173
GHSA-qcfx-2mfw-w4cg
Summary Rails Active Storage has possible content type bypass via metadata in direct uploads ### Impact Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a malicious direct-upload client could set these flags. ### Releases The fixed releases are available at the normal locations.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-925 Improper Verification of Intent by Broadcast Receiver
CWE-1287 Improper Validation of Specified Type of Input
System Score Found at
cvssv3 7.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33173.json
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-33173
cvssv3.1 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-qcfx-2mfw-w4cg
cvssv4 5.3 https://github.com/rails/rails
generic_textual MODERATE https://github.com/rails/rails
cvssv4 5.3 https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
generic_textual MODERATE https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
ssvc Track https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
cvssv4 5.3 https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
generic_textual MODERATE https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
ssvc Track https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
cvssv4 5.3 https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
generic_textual MODERATE https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
ssvc Track https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
cvssv4 5.3 https://github.com/rails/rails/releases/tag/v7.2.3.1
generic_textual MODERATE https://github.com/rails/rails/releases/tag/v7.2.3.1
ssvc Track https://github.com/rails/rails/releases/tag/v7.2.3.1
cvssv4 5.3 https://github.com/rails/rails/releases/tag/v8.0.4.1
generic_textual MODERATE https://github.com/rails/rails/releases/tag/v8.0.4.1
ssvc Track https://github.com/rails/rails/releases/tag/v8.0.4.1
cvssv4 5.3 https://github.com/rails/rails/releases/tag/v8.1.2.1
generic_textual MODERATE https://github.com/rails/rails/releases/tag/v8.1.2.1
ssvc Track https://github.com/rails/rails/releases/tag/v8.1.2.1
cvssv3.1_qr MODERATE https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
cvssv4 5.3 https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
generic_textual MODERATE https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
ssvc Track https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-33173
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-33173
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33173.json
https://api.first.org/data/v1/epss?cve=CVE-2026-33173
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33173
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rails/rails
https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
https://github.com/rails/rails/releases/tag/v7.2.3.1
https://github.com/rails/rails/releases/tag/v8.0.4.1
https://github.com/rails/rails/releases/tag/v8.1.2.1
https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
https://nvd.nist.gov/vuln/detail/CVE-2026-33173
1132035 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132035
2450545 https://bugzilla.redhat.com/show_bug.cgi?id=2450545
GHSA-qcfx-2mfw-w4cg https://github.com/advisories/GHSA-qcfx-2mfw-w4cg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33173.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:14:22Z/ Found at https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:14:22Z/ Found at https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:14:22Z/ Found at https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails/releases/tag/v7.2.3.1
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:14:22Z/ Found at https://github.com/rails/rails/releases/tag/v7.2.3.1
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails/releases/tag/v8.0.4.1
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:14:22Z/ Found at https://github.com/rails/rails/releases/tag/v8.0.4.1
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails/releases/tag/v8.1.2.1
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:14:22Z/ Found at https://github.com/rails/rails/releases/tag/v8.1.2.1
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T14:14:22Z/ Found at https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-33173
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0229
EPSS Score 0.00013
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:53:54.575093+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-qcfx-2mfw-w4cg/GHSA-qcfx-2mfw-w4cg.json 38.0.0