Most recent entries from all

EUVD-2026-365768

fkie_cve-2026-53769

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.

GHSA-pqpw-cvm4-8mv9 — Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Affected: RubyGems: avo

### Summary

Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as `upload_{FIELD_ID}?`.

An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both `update?` and `upload_<field>?` policies deny the operation.

This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies.

### Details

Avo exposes a direct attachment upload endpoint:

```text POST /<avo-root>/avo_api/resources/:resource_name/:id/attachments/ ```

The vulnerable code path is `Avo::AttachmentsController#create`:

- `app/controllers/avo/attachments_controller.rb:9-24`

Current behavior:

```ruby def create blob = ActiveStorage::Blob.create_and_upload! io: params[:file].to_io, filename: params[:filename] association_name = BaseResource.valid_attachment_name(@record, params[:attachment_key])

if association_name @record.send(association_name).attach blob elsif params[:key].blank? raise ActionController::BadRequest.new(...) end

render json: { url: main_app.url_for(blob), href: main_app.url_for(blob) } end ```

This endpoint creates an `ActiveStorage::Blob` before validating the requested…