Summaryinfo

A vulnerability identified as problematic has been detected in rails activestorage. Affected by this vulnerability is the function DirectUploadsController. This manipulation causes intent by broadcast receiver. This vulnerability is tracked as CVE-2026-33173. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in rails activestorage. It has been declared as problematic. Affected by this vulnerability is the function DirectUploadsController. The manipulation with an unknown input leads to a intent by broadcast receiver vulnerability. The CWE definition for the vulnerability is CWE-925. The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source. As an impact it is known to affect integrity. The summary by CVE is:

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-33173 since 03/17/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.2.3.1, 8.0.4.1 or 8.1.2.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 707c0f1f41f067fdf96d54e99d43b28dfaae7e53 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• rails

Name

• activestorage

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion