Skip to content
Threat Feed
Subscribe

Tag

Active-Storage

3 briefs RSS
high advisory

Decidim Vulnerability Allows Unauthorized Access to Identity Documents via Reusable Signed URLs

A high-severity vulnerability (CVE-2026-45378) in Decidim's identity document verification workflow allows unauthorized access to sensitive identity documents. Signed `/rails/active_storage/disk/` URLs, which are generated for administrator review, can be harvested and replayed by unauthenticated users for up to seven days, enabling attackers to bypass authentication and download highly sensitive personal information if these URLs are leaked through various channels.

Decidim +2 web-vulnerability access-control data-leakage rails active-storage
1r 1t
medium advisory

Ruby on Rails Active Storage DoS Vulnerability (CVE-2026-33174)

A denial-of-service vulnerability (CVE-2026-33174) exists in Ruby on Rails Active Storage versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1 due to unbounded memory allocation when handling large or unbounded Range headers in proxy delivery mode.

rails active-storage dos cve-2026-33174
2r 1t
high advisory

Rails Active Storage Path Traversal Vulnerability

A path traversal vulnerability (CVE-2026-33195) exists in Rails Active Storage's DiskService#path_for, potentially allowing attackers to read, write, or delete arbitrary files on the server by crafting blob keys with path traversal sequences, impacting applications that pass user input as blob keys.

Active Storage rails path traversal cve-2026-33195
2r 1t