DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-PMWX-RM49-XV39: GHSA-PMWX-RM49-XV39: Path Traversal in ActiveRecord::Tenanted::Storage::DiskService

#security #cve #cybersecurity #ghsa

GHSA-PMWX-RM49-XV39: Path Traversal in ActiveRecord::Tenanted::Storage::DiskService

Vulnerability ID: GHSA-PMWX-RM49-XV39
CVSS Score: 9.1
Published: 2026-07-29

A directory traversal vulnerability exists in the activerecord-tenanted Ruby gem's local storage path resolution logic. Prior to version 0.7.0, the path_for method failed to sanitize input keys, allowing remote attackers to traverse directories and access arbitrary files on the host filesystem.

TL;DR

A path traversal vulnerability in activerecord-tenanted allows attackers to read or write arbitrary files on the host system by manipulating ActiveStorage keys.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network (AV:N)
  • CVSS Score: 9.1
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • Ruby on Rails applications using activerecord-tenanted and local disk storage
  • activerecord-tenanted: < 0.7.0 (Fixed in: 0.7.0)

Code Analysis

Commit: b242c8a

Fix path traversal in DiskService#path_for

@@ -1,13 +1,28 @@\n-        def path_for(key)\n-          if ActiveRecord::Tenanted.connection_class && key.include?(\"/\")\n-            tenant, key = key.split(\"/\", 2)\n-            File.join(root, tenant, folder_for(key), key)\n-          else\n-            super\n-          end\n-        end\n+        def path_for(key)\n+          return super unless ActiveRecord::Tenanted.connection_class && key.include?(\"/\")\n+\n+          if key.split(\"/\").intersect?(%w[. ..])\n+            raise ActiveStorage::InvalidKeyError, \"key has path traversal segments\"\n+          end\n+\n+          tenant, key = key.split(\"/\", 2)\n+\n+          if tenant.blank? || key.blank?\n+            raise ActiveStorage::InvalidKeyError, \"key has a blank segment\"\n+          end\n+\n+          begin\n+            path = File.expand_path(File.join(root, tenant, folder_for(key), key))\n+          rescue ArgumentError\n+            raise ActiveStorage::InvalidKeyError, \"key is an invalid string\"\n+          end\n+\n+          unless path.start_with?(File.expand_path(root) + \"/\")\n+            raise ActiveStorage::InvalidKeyError, \"key is outside of disk service root\"\n+          end\n+\n+          path\n+        rescue Encoding::CompatibilityError\n+          raise ActiveStorage::InvalidKeyError, \"key has incompatible encoding\"\n+          end\n+        end
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade the activerecord-tenanted gem to version 0.7.0 or higher.
  • Upgrade Rails dependencies to 8.1.2.1 or higher to support the needed exceptions.
  • Enforce strict filesystem isolation for the application process.

Remediation Steps:

  1. Identify vulnerable versions of the activerecord-tenanted gem in Gemfile.lock.
  2. Update your Gemfile to specify version 0.7.0 or newer.
  3. Run bundle update activerecord-tenanted to update dependencies.
  4. Deploy the updated application to production and monitor disk services for InvalidKeyError exceptions.

References

Read the full report for GHSA-PMWX-RM49-XV39 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)