GHSA-pmwx-rm49-xv39
ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal
Summary
Active Record Tenanted's override of Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
Mitigation
Upgrade to Active Record Tenanted v0.7.0 or later.
As a workaround, do not use untrusted user input as blob keys. Blob keys are expected to be trusted strings.
Credit
This issue was responsibly reported by @tonghuaroot.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
GitHub Advisories Score used
ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal
Summary
Active Record Tenanted's override of Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
Mitigation
Upgrade to Active Record Tenanted v0.7.0 or later.
As a workaround, do not use untrusted user input as blob keys. Blob keys are expected to be trusted strings.
Credit
This issue was responsibly reported by @tonghuaroot.
- Record
GHSA-pmwx-rm49-xv39- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal
Summary
Active Record Tenanted's override of Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
Mitigation
Upgrade to Active Record Tenanted v0.7.0 or later.
As a workaround, do not use untrusted user input as blob keys. Blob keys are expected to be trusted strings.
Credit
This issue was responsibly reported by @tonghuaroot.
- Record
GHSA-pmwx-rm49-xv39- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecord-tenantedRubyGems | before 0.7.0 | 0.7.0 |
activerecord-tenantedRubyGems | before 0.7.0, plus listed versions 0.1.00.2.00.3.00.4.00.4.10.5.00.6.0 | 0.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-pmwx-rm49-xv39 is a low vulnerability (CVSS 2.3) in activerecord-tenanted, published July 29, 2026. No source lists public exploit code. Fixed in activerecord-tenanted 0.7.0.
References
github.com/basecamp/activerecord-tenanted/security/advisories/GHSA-pmwx-rm49-xv39