Active Storage's GCS service with the cache_control option configured signs direct-upload URLs using V4 signatures that do not cover the Content-Type header. This allows an attacker to upload objects with arbitrary Content-Type metadata, potentially serving malicious HTML content from the storage bucket. The vulnerability is fixed by reverting to V2 signing, which includes Content-Type and Content-MD5 in the signature. Fixed versions are 8.1.4.1 and 8.0.5.2.