Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects.
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cache_control option, ActiveStorage::Service::GCSService#url_for_direct_upload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the response-content-type that Active Storage sets on download URLs, so an uploaded object
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Ruby on Rails
- Product
- rails
- CVSS v3.1
- 4.7 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Fix
- available
- Weakness
- CWE-345
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 28 (Notable)
- CVSS v3.1 4.7 medium
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-126084 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.