activestorage vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-33658Lowactivestorage: Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests CVE-2026-33202Mediumactivestorage: Rails Active Storage has possible glob injection in its DiskService CVE-2026-33195Highactivestorage: Rails Active Storage has possible Path Traversal in DiskService CVE-2026-33174Mediumactivestorage: Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests CVE-2026-33173Mediumactivestorage: Rails Active Storage has possible content type bypass via metadata in direct uploads CVE-2025-24293Criticalactivestorage: Active Storage allowed transformation methods that were potentially unsafe CVE-2024-26144Mediumactivestorage: Rails has possible Sensitive Session Information Leak in Active Storage CVE-2022-21831Criticalactivestorage: Possible code injection vulnerability in Rails / Active Storage CVE-2020-8162Highactivestorage: Circumvention of file size limits in ActiveStorage CVE-2018-16477Mediumactivestorage: Exposure of Sensitive Information to an Unauthorized Actor in activestorage

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo