A path traversal weakness exists in the DiskService#path_for routine of Ruby on Rails Active Storage. The routine builds a file system path from a blob key without confirming that the resulting path stays within the storage root. If a key containing sequences like "../" is supplied, the application can read, overwrite, or delete files anywhere on the host file system. This flaw is classified as a path traversal vulnerability (CWE‑22) and can compromise confidentiality, integrity, and availability whenever the blob key originates from untrusted sources.

The weakness affects all Rails releases prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1. Rails applications that accept user‑controlled values as the blob key are at risk. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch that validates the resolved path, and later releases are not vulnerable.

The vulnerability receives a high severity rating of 8 on the common assessment scale. Current exploitation likelihood is very low, as indicated by a probability score below 1 percent, and it is not listed in the known exploited vulnerabilities catalog. The attack vector is likely remote via HTTP requests that provide a malicious blob key, but local execution within the Rails process can also trigger the flaw. Because the flaw permits arbitrary file manipulation, remedial action is imperative.