https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:01:16.049676+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2020-8162 CVE-2020-8162 2026-10-06T05:01:16.080130+00:00

Affected: https://github.com/rails/rails

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

 https://cve.radiocsirt.org/vuln/ghsa-m42x-37p3-fv5w GHSA-m42x-37p3-fv5w — Circumvention of file size limits in ActiveStorage 2026-10-06T05:01:16.080187+00:00

Affected: RubyGems: activestorage

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.

Versions Affected: rails < 5.2.4.2, rails < 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact ------

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds -----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.