{"uuid": "920638fb-cb96-4b32-b9ce-317034863bd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-PMWX-RM49-XV39", "type": "seen", "source": "https://gist.github.com/alon710/c7232e977481fa394270e416ffc6a506", "content": "# GHSA-PMWX-RM49-XV39: GHSA-PMWX-RM49-XV39: Path Traversal in ActiveRecord::Tenanted::Storage::DiskService\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/GHSA-PMWX-RM49-XV39\n\n## Summary\nA directory traversal vulnerability exists in the `activerecord-tenanted` Ruby gem's local storage path resolution logic. Prior to version 0.7.0, the `path_for` method failed to sanitize input keys, allowing remote attackers to traverse directories and access arbitrary files on the host filesystem.\n\n## TL;DR\nA path traversal vulnerability in `activerecord-tenanted` allows attackers to read or write arbitrary files on the host system by manipulating ActiveStorage keys.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.1\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ruby on Rails applications using activerecord-tenanted and local disk storage\n- **activerecord-tenanted**: < 0.7.0 (Fixed in: `0.7.0`)\n\n## Mitigation\n\n- Upgrade the activerecord-tenanted gem to version 0.7.0 or higher.\n- Upgrade Rails dependencies to 8.1.2.1 or higher to support the needed exceptions.\n- Enforce strict filesystem isolation for the application process.\n\n**Remediation Steps:**\n1. Identify vulnerable versions of the activerecord-tenanted gem in Gemfile.lock.\n2. Update your Gemfile to specify version 0.7.0 or newer.\n3. Run `bundle update activerecord-tenanted` to update dependencies.\n4. Deploy the updated application to production and monitor disk services for InvalidKeyError exceptions.\n\n## References\n\n- [GitHub Security Advisory Page](https://github.com/advisories/GHSA-PMWX-RM49-XV39)\n- [Repository Security Advisory](https://github.com/basecamp/activerecord-tenanted/security/advisories/GHSA-pmwx-rm49-xv39)\n- [Fix Pull Request #307](https://github.com/basecamp/activerecord-tenanted/pull/307)\n- [Vulnerability Fix Commit](https://github.com/basecamp/activerecord-tenanted/commit/b242c8ad9bf58bbd7f5a032d153b0f29db54b9ba)\n- [v0.7.0 Release Page](https://github.com/basecamp/activerecord-tenanted/releases/tag/v0.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PMWX-RM49-XV39) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T21:31:26.317304Z"}