CVE-2026-33195 is a CWE-22 path traversal vulnerability in the Rails Active Storage component. The vulnerability arises because the DiskService#path_for method does not ensure that the resolved filesystem path stays within the designated storage root directory. If an attacker can supply a blob key containing path traversal sequences (e.g., '../'), they may manipulate file paths to access or modify files outside the intended directory. This is particularly impactful if applications use user-supplied input as blob keys, which is not the expected usage. The issue is fixed in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1.

Exploitation of this vulnerability could allow an attacker to read, write, or delete arbitrary files on the server hosting the Rails application. This can lead to unauthorized data access or modification, potentially compromising the integrity and confidentiality of the system. The CVSS 4.0 base score is 8.0 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

A patch is available in Rails Active Storage versions 8.1.2.1, 8.0.4.1, and 7.2.3.1. Users should upgrade to one of these fixed versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these official fixes. Applications should also ensure that blob keys are not derived from untrusted user input to reduce risk.