CVE-2026-33173 Rails Active Storage has possible content type bypass via metadata in direct uploads
Attackers can bypass content type validations in Rails Active Storage direct uploads by manipulating metadata flags to skip MIME detection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33173?
CVE-2026-33173 is a medium-severity vulnerability in Rubyonrails Rails, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Weakness: CWE-925
Which versions are affected by CVE-2026-33173?
6 open source packages ship an affected version, including activestorage. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
activestorage RubyGems | All versions | 7.2.3.1 |
activestorage RubyGems | All versions | 7.2.3.1 |
activestorage RubyGems | From 8.0.0.beta1 | 8.0.4.1 |
activestorage RubyGems | From 8.0.0.beta1 | 8.0.4.1 |
activestorage RubyGems | From 8.1.0.beta1 | 8.1.2.1 |
activestorage RubyGems | From 8.1.0.beta1 | 8.1.2.1 |
Products include Rubyonrails Rails.
How do I fix CVE-2026-33173?
Upgrade activestorage to a fixed version for your release line: 7.2.3.1, 8.0.4.1 or 8.1.2.1.
Is CVE-2026-33173 being exploited?
There is no known exploitation of CVE-2026-33173 in the wild and no public exploit code.
Other vulnerabilities in Rubyonrails Rails
- CVE-2013-0277 Active Record contains deserialization of arbitrary YAML
- CVE-2017-17916 SQL injection in n/a
- CVE-2017-17917 SQL injection in n/a
- CVE-2026-33195 Rails Active Storage has possible Path Traversal in DiskService
- CVE-2024-26142 Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Sources
Also known as DEBIAN-CVE-2026-33173, GHSA-qcfx-2mfw-w4cg, UBUNTU-CVE-2026-33173.