The vulnerability occurs when direct uploads are processed by Rails Active Storage: metadata supplied by the client is persisted on blobs, including internal flags such as identified and analyzed. An attacker can set these to skip automatic MIME type detection and content analysis, allowing arbitrary files to be stored under a benign content_type. This bypasses any validation that relies on content type identification, potentially leading to the execution of malicious code or the storage of unwanted content.

The flaw affects Rails Active Storage, specifically versions before 8.1.2.1, 8.0.4.1, and 7.2.3.1. Any Rails application that uses Active Storage and has not applied the corresponding patch is vulnerable. The issue resides in the DirectUploadsController component of the Rails framework.

The vulnerability has a CVSS score of 5.3, indicating medium severity, and a very low EPSS probability of less than 1%. It is not listed in the CISA KEV catalog. Attackers can exploit it by crafting a direct-upload request that includes privileged metadata keys; the required conditions are served over the network, making the attack remote. The bypass allows uploading arbitrary data while deceiving the application into treating it as safe.