https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:30:41 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07234 bdu:2026-07234 https://cve.radiocsirt.org/vuln/bdu:2026-07234 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/euvd-2026-355322 EUVD-2026-355322 https://cve.radiocsirt.org/vuln/euvd-2026-355322 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33195 <p>Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage&#39;s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> <p>Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage&#39;s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33195 https://cve.radiocsirt.org/vuln/ghsa-9xrj-h377-fr87 <p><strong>Affected:</strong> RubyGems: activestorage</p> <p>### Impact Active Storage&#39;s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.</p> <p>### Releases The fixed releases are available at the normal locations.</p> <p>### Credit This issue was responsibly reported by Hackerone researcher [ksw9722](https://hackerone.com/ksw9722).</p> <p><strong>Affected:</strong> RubyGems: activestorage</p> <p>### Impact Active Storage&#39;s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.</p> <p>### Releases The fixed releases are available at the normal locations.</p> <p>### Credit This issue was responsibly reported by Hackerone researcher [ksw9722](https://hackerone.com/ksw9722).</p> https://cve.radiocsirt.org/vuln/ghsa-9xrj-h377-fr87 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33195 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails</p> <p>Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage&#39;s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails</p> <p>Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage&#39;s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33195 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833 <p>Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833