https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:01:48.758834+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07234 bdu:2026-07234 2026-10-03T18:01:48.860342+00:00 bdu:2026-07234 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 certfr-2026-avi-0349 — De multiples vulnérabilités ont été découvertes dans les produits Ruby on Rails. Certaines d'entre elles permettent à u… 2026-10-03T18:01:48.860380+00:00 certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/euvd-2026-355322 EUVD-2026-355322 2026-10-03T18:01:48.860398+00:00 EUVD-2026-355322 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33195 fkie_cve-2026-33195 2026-10-03T18:01:48.860411+00:00

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

 https://cve.radiocsirt.org/vuln/ghsa-9xrj-h377-fr87 GHSA-9xrj-h377-fr87 — Rails Active Storage has possible Path Traversal in DiskService 2026-10-03T18:01:48.860445+00:00

Affected: RubyGems: activestorage

### Impact Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone researcher [ksw9722](https://hackerone.com/ksw9722).

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33195 UBUNTU-CVE-2026-33195 2026-10-03T18:01:48.860475+00:00

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833 WID-SEC-W-2026-0833 — Ruby on Rails: Mehrere Schwachstellen 2026-10-03T18:01:48.860509+00:00

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.