Rails Active Storage hat möglicherweise Path Traversal in DiskService

The core of the vulnerability lies in the DiskService#path_for method within Active Storage, which fails to properly validate that the resolved filesystem path remains within the designated storage root directory. An attacker can exploit this by crafting a malicious blob key containing path traversal sequences. For example, a key like ../../../../etc/passwd could allow an attacker to read sensitive system files. The ability to write arbitrary files could lead to remote code execution if the attacker can overwrite executable files or inject malicious code into application assets. The blast radius extends to any application utilizing Active Storage with untrusted user input being used as blob keys.

Applications built with Ruby on Rails that utilize Active Storage and accept user-provided data as blob keys are at significant risk. This includes e-commerce platforms allowing users to upload images, content management systems with user-generated content, and any application where user input is directly incorporated into Active Storage blob keys without proper sanitization.

• ruby / server:

find /path/to/rails/app/models -name '*.rb' -print0 | xargs -0 grep -i 'DiskService#path_for'

• ruby / server:

journalctl -u puma -g 'ActiveStorage::DiskService#path_for' | grep '../'

• generic web:

curl -I 'https://example.com/active_storage/blobs/some_malicious_key../sensitive_file' 

1. 2026-03-23Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-23
3. Geändert2026-03-25
4. EPSS aktualisiert2026-03-31

The primary mitigation is to upgrade to Ruby on Rails Active Storage version 8.1.2.1 or later, which includes the necessary validation to prevent path traversal. If upgrading immediately is not feasible, consider implementing input validation on blob keys to sanitize against path traversal sequences before they are used. Web application firewalls (WAFs) configured to detect and block requests containing path traversal patterns can provide an additional layer of defense. Regularly review and audit Active Storage configurations to ensure that blob keys are handled securely and that user input is properly validated.