CVE-2026-33202

What it actually does

Active Storage DiskService in affected Rails versions passes blob-key-derived prefixes directly into Dir.glob without escaping glob metacharacters. If an application permits attacker-influenced or custom-generated Active Storage keys containing characters such as *, ?, [, ], {, or }, the delete_prefixed operation can expand the pattern and delete files other than the intended object within the disk storage directory. The impact is primarily integrity loss: unintended stored files can be removed, corrupting application-managed uploads, variants, previews, or other disk-backed Active Storage objects.

Why it matters to the business

Successful exploitation can cause loss or corruption of user-uploaded files, documents, media, or generated assets stored through local Active Storage, leading to broken application functionality, customer-impacting data loss, support escalations, restoration costs, and potential contractual or regulatory issues if records must be retained. The issue has a high severity score but currently has low EPSS, no known CISA KEV listing, and no reported exploit maturity, so remediation should be prioritized for applications using Active Storage DiskService or custom blob-key generation but treated as less urgent than actively exploited internet-facing vulnerabilities.

How an attack unfolds

An attacker first identifies a Rails application feature that creates or attaches Active Storage blobs and where the resulting storage key can be influenced directly or indirectly, such as through custom key generation, import workflows, integrations, or unsafe use of user input in blob keys. The attacker supplies a key or key component containing glob metacharacters. Later, when the application invokes Active Storage cleanup behavior that calls DiskService#delete_prefixed for that key prefix, Rails constructs a filesystem glob pattern without escaping those metacharacters. The operating system file matching expands the pattern to additional paths under the storage directory, and Rails deletes the matched files. The attacker does not need to read files or execute code; the abuse is causing Rails to delete unintended storage objects through malformed keys and a vulnerable cleanup path.

How to fix it

Upgrade Rails to a patched version: 8.1.2.1 or later for the 8.1 branch, 8.0.4.1 or later for the 8.0 branch, and 7.2.3.1 or later for the 7.2 branch. If immediate upgrade is not possible, mitigate by ensuring Active Storage blob keys are generated only by Rails’ safe default key generator, rejecting any custom key containing glob metacharacters, and auditing custom code that calls DiskService#delete_prefixed or derives blob keys from user input. Avoid using local DiskService for untrusted upload workflows where feasible until patched. Maintain tested backups of the Active Storage disk directory so unintended deletion can be recovered.

How to confirm the fix worked

Confirm the deployed Rails version is one of the patched releases or later in the applicable branch. Review dependency manifests and lockfiles to verify the runtime version actually loaded by the application. Search application code for custom Active Storage key generation, direct use of DiskService#delete_prefixed, or blob keys built from request parameters, filenames, tenant identifiers, import metadata, or external integration values. In a non-production test environment, attempt to create a blob key containing glob metacharacters and verify deletion operations do not expand the pattern to unrelated files. For disk-backed deployments, inspect storage contents and application references for unexpected missing files after purge or cleanup jobs.

Typical attack path

1. Find a Rails application using Active Storage with the DiskService backend or disk-backed storage in an exposed workflow.
2. Identify an upload, attachment, import, migration, or integration path where blob keys are attacker-controlled or generated from attacker-controlled input.
3. Create or trigger creation of a blob key containing glob metacharacters such as *, ?, [], or {}.
4. Trigger application behavior that deletes by prefix, such as attachment cleanup, variant cleanup, purge operations, or custom code calling delete_prefixed.
5. Allow the vulnerable Dir.glob expansion to match more files than intended within the storage directory.
6. Cause Rails to delete unintended Active Storage files, resulting in missing uploads, broken assets, or data loss.

How to detect it

To determine whether exploitation already occurred, focus on evidence of suspicious Active Storage keys and unexpected deletion activity. Review Rails application logs, background job logs, Active Storage service logs, web request logs for upload or attachment endpoints, and storage filesystem metadata. Look for blob keys or key prefixes containing glob metacharacters such as *, ?, [, ], {, or }, especially near purge, delete, cleanup, or attachment-destroy events. Investigate abnormal spikes in file deletions, missing stored objects, broken attachment references, or cleanup jobs deleting far more files than expected. Compare storage directory snapshots or backups against current contents to identify broad deletion patterns following a single purge operation. Because exploitation does not require malware, command execution, or outbound network traffic, filesystem deletion traces, application-level key values, and job execution records are the most useful sources.

• ActiveStorage::Service::DiskService#delete_prefixed
• delete_prefixed
• Dir.glob
• ActiveStorage::FileNotFoundError
• *
• ?
• [
• ]
• {
• }

What your security team should do

• Prioritize upgrading Rails to 8.1.2.1, 8.0.4.1, 7.2.3.1, or later for all applications using Active Storage DiskService.
• Inventory Rails applications using Active Storage and determine whether any use local disk storage in production, staging, CI, or internal tooling.
• Review custom blob-key generation and reject keys containing glob metacharacters or any user-derived path components.
• Audit application code and scheduled jobs for direct calls to ActiveStorage::Service::DiskService#delete_prefixed or custom cleanup routines that delete by prefix.
• Check recent purge, cleanup, and attachment deletion activity for abnormal volume or unusual key patterns.
• Verify backups and restore procedures for Active Storage disk directories before performing large cleanup jobs.
• If suspicious deletion is found, preserve application logs, job logs, storage directory metadata, and relevant blob metadata before remediation changes overwrite evidence.