GHSA-pmwx-rm49-xv39 ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal
Path traversal in Active Record Tenanted allows attackers to read, write, or delete arbitrary files if untrusted input is used as blob keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-pmwx-rm49-xv39?
GHSA-pmwx-rm49-xv39 is a path traversal vulnerability in activerecord-tenanted, published on 29 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Summary
Active Record Tenanted's override of Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
Mitigation
Upgrade to Active Record Tenanted v0.7.0 or later.
As a workaround, do not use untrusted user input as blob keys. Blob keys are expected to be trusted strings.
Credit
This issue was responsibly reported by @tonghuaroot.
Which versions are affected by GHSA-pmwx-rm49-xv39?
2 open source packages ship an affected version, including activerecord-tenanted.
| Package | Affected | Fixed in |
|---|---|---|
activerecord-tenanted RubyGems | All versions | 0.7.0 |
activerecord-tenanted RubyGems | All versions | 0.7.0 |
How do I fix GHSA-pmwx-rm49-xv39?
Upgrade activerecord-tenanted to 0.7.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-pmwx-rm49-xv39 being exploited?
There is no known exploitation of GHSA-pmwx-rm49-xv39 in the wild and no public exploit code.