CVE-2026-33202: Rails Active Storage Path Traversal Flaw

CVE-2026-33202 Overview

CVE-2026-33202 is an injection vulnerability in Ruby on Rails Active Storage that allows attackers to delete arbitrary files from the storage directory. The vulnerability exists in the DiskService#delete_prefixed method, which passes blob keys directly to Ruby's Dir.glob function without properly escaping glob metacharacters. When attacker-controlled input or custom-generated keys contain glob metacharacters (such as *, ?, [, ], or {}), the glob pattern matching can be manipulated to target unintended files for deletion.

Critical Impact

Attackers can exploit this glob injection vulnerability to delete arbitrary files from the Active Storage directory, potentially causing data loss, service disruption, or undermining application integrity by removing critical stored assets.

Affected Products

• Ruby on Rails versions prior to 7.2.3.1
• Ruby on Rails versions 8.0.x prior to 8.0.4.1
• Ruby on Rails versions 8.1.x prior to 8.1.2.1

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-33202 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33202

Vulnerability Analysis

This vulnerability represents a classic injection flaw where user-controllable data flows into a sensitive function without proper sanitization. Active Storage's disk-based storage service provides a delete_prefixed method designed to remove files matching a specific prefix pattern. However, the implementation directly concatenates the prefix with a wildcard character and passes it to Dir.glob, which interprets glob metacharacters in the input.

Ruby's Dir.glob function supports pattern matching characters including * (matches any string), ? (matches any single character), [...] (character classes), and {a,b} (alternation). When an attacker can influence the blob key value—either through direct input or by manipulating custom key generation logic—they can craft keys containing these metacharacters to expand the scope of file deletion beyond the intended targets.

The impact is limited to file deletion within the storage directory structure, but this can have significant consequences for applications relying on Active Storage for critical asset management. Data loss, broken application functionality, and denial of service conditions are all potential outcomes.

Root Cause

The root cause is the failure to escape glob metacharacters before passing user-influenced data to Dir.glob. The vulnerable code constructs a glob pattern by appending * to the prefix path without first escaping any special characters that may already exist in the prefix. This violates the security principle of treating all external input as potentially malicious and properly sanitizing it before use in sensitive operations.

Attack Vector

An attacker can exploit this vulnerability through any code path that allows influence over blob key values. This could occur in applications that:

1. Allow users to specify custom blob keys during file uploads
2. Generate blob keys using user-controlled input without proper validation
3. Accept blob key prefixes for batch deletion operations

The attacker crafts a blob key containing glob metacharacters designed to match unintended files. When delete_prefixed is invoked with this malicious key, the glob expansion causes FileUtils.rm_rf to be called on files beyond the intended scope.

# Vulnerable code (before patch)
def delete_prefixed(prefix)
  instrument :delete_prefixed, prefix: prefix do
    Dir.glob(path_for("#{prefix}*")).each do |path|
      FileUtils.rm_rf(path)
    end
  end
end

# Patched code - escapes glob metacharacters
def delete_prefixed(prefix)
  instrument :delete_prefixed, prefix: prefix do
    prefix_path = path_for(prefix)

    # File.expand_path (called within path_for) strips trailing slashes.
    # Restore trailing separator if the original prefix had one, so that
    # the glob "prefix/*" matches files inside the directory, not siblings
    # whose names start with the prefix string.
    prefix_path += "/" if prefix.end_with?("/")

    escaped = escape_glob_metacharacters(prefix_path)
    Dir.glob("#{escaped}*").each do |path|
      FileUtils.rm_rf(path)
    end
  end
end

Source: Rails Security Patch

Detection Methods for CVE-2026-33202

Indicators of Compromise

• Unexpected file deletions in Active Storage directories
• Application logs showing delete_prefixed operations with unusual prefix patterns containing glob metacharacters (*, ?, [, ], {, })
• Missing stored attachments that cannot be explained by normal application behavior
• Error messages related to missing blob files in application logs

Detection Strategies

• Monitor Active Storage operations for prefix patterns containing glob metacharacters
• Implement file integrity monitoring on storage directories to detect unexpected deletions
• Review application code for any paths where user input can influence blob key generation
• Audit custom blob key generation logic for proper input validation

Monitoring Recommendations

• Enable detailed logging for Active Storage delete_prefixed operations
• Set up alerts for unusual patterns in storage directory file deletion activity
• Monitor application error rates related to missing attachments or blob files
• Implement periodic integrity checks comparing expected vs actual stored files

How to Mitigate CVE-2026-33202

Immediate Actions Required

• Upgrade Ruby on Rails to version 7.2.3.1, 8.0.4.1, or 8.1.2.1 immediately
• Audit application code for any custom blob key generation that incorporates user input
• Review and sanitize any code paths that allow users to influence blob key values
• Implement input validation to reject blob keys containing glob metacharacters

Patch Information

Security patches are available for all affected Rails versions. The fix introduces proper escaping of glob metacharacters in the prefix path before passing it to Dir.glob. The patch also handles edge cases around trailing slashes to ensure correct directory matching behavior.

Patched versions:

• Rails 7.2.3.1
• Rails 8.0.4.1
• Rails 8.1.2.1

For detailed patch information, see the GitHub Security Advisory GHSA-73f9-jhhh-hr5m.

Workarounds

• If immediate patching is not possible, implement application-level input validation to strip or reject glob metacharacters from any user-controlled blob key inputs
• Consider temporarily restricting access to functionality that invokes delete_prefixed with user-influenced prefixes
• Implement a wrapper around delete_prefixed that sanitizes the prefix parameter before calling the original method

# Temporary workaround - sanitize prefix before delete operations
def safe_delete_prefixed(prefix)
  # Escape glob metacharacters before calling delete_prefixed
  sanitized_prefix = prefix.gsub(/[\[\]\{\}\*\?\\]/) { |char| "\\#{char}" }
  ActiveStorage::Blob.service.delete_prefixed(sanitized_prefix)
end