Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-xr9x-r78c-5hrm
  • RubyGems/activestorage
 Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing 30 Jul
  • Fix available
  • Severity - 9.5 (Critical)
GHSA-p9fm-f462-ggrg
  • RubyGems/activestorage
 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests 25 Mar
  • Fix available
  • Severity - 2.3 (Low)
GHSA-73f9-jhhh-hr5m
  • RubyGems/activestorage
 Rails Active Storage has possible glob injection in its DiskService 23 Mar
  • Fix available
  • Severity - 6.6 (Medium)
GHSA-9xrj-h377-fr87
  • RubyGems/activestorage
 Rails Active Storage has possible Path Traversal in DiskService 23 Mar
  • Fix available
  • Severity - 8.0 (High)
GHSA-r46p-8f7g-vvvg
  • RubyGems/activestorage
 Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests 23 Mar
  • Fix available
  • Severity - 6.6 (Medium)
GHSA-qcfx-2mfw-w4cg
  • RubyGems/activestorage
 Rails Active Storage has possible content type bypass via metadata in direct uploads 23 Mar
  • Fix available
  • Severity - 5.3 (Medium)
MAL-2025-192894
  • RubyGems/activestorage-redundancy
 Malicious code in activestorage-redundancy (RubyGems) 23 Dec 2025
  • No fix available
GHSA-r4mg-4433-c7g3
  • RubyGems/activestorage
 Active Storage allowed transformation methods that were potentially unsafe 14 Aug 2025
  • Fix available
  • Severity - 9.2 (Critical)
GHSA-8h22-8cf7-hq6g
  • RubyGems/activestorage
 Rails has possible Sensitive Session Information Leak in Active Storage 27 Feb 2024
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-w749-p3v6-hccq
  • RubyGems/activestorage
 Possible code injection vulnerability in Rails / Active Storage 08 Mar 2022
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-m42x-37p3-fv5w
  • RubyGems/activestorage
 Circumvention of file size limits in ActiveStorage 26 May 2020
  • Fix available
  • Severity - 7.5 (High)
GHSA-7rr7-rcjw-56vj
  • RubyGems/activestorage
 Exposure of Sensitive Information to an Unauthorized Actor in activestorage 05 Dec 2018
  • Fix available
  • Severity - 6.5 (Medium)