Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects.
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Googl
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Ruby on Rails
- Product
- rails
- CVSS v3.1
- 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Fix
- available
- Weakness
- CWE-602
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 28 (Notable)
- CVSS v3.1 5.3 medium
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-126085 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.