DeutschShown in its original language — a full translation is planned for a future version.
Ruby on Rails: Mehrere Schwachstellen
view advisory published 2026-03-23
Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-33658US | medium6.5 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit… | ||||
| CVE-2026-33202US | critical9.1 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` p… | ||||
| CVE-2026-33195US | critical9.8 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not… | ||||
| CVE-2026-33176US | high7.5 | — | ||
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number… | ||||
| CVE-2026-33174US | high7.5 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's prox… | ||||
| CVE-2026-33173US | medium5.3 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary meta… | ||||
| CVE-2026-33170US | medium6.1 | — | ||
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does n… | ||||
| CVE-2026-33169US | medium5.3 | — | ||
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression… | ||||
| CVE-2026-33168US | — | — | ||
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTM… | ||||
| CVE-2026-33167US | medium6.1 | — | ||
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape ex… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:14835 vom 2026-05-07external
- Red Hat Security Advisory RHSA-2026:14873 vom 2026-05-07external
- Red Hat Security Advisory RHSA-2026:14874 vom 2026-05-07external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
- Rails Security Advisory vom 2026-03-23external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan