Active Storage allows Rails applications to attach cloud and local files. In versions earlier than 7.2.3.1, 8.0.4.1, and 8.1.2.1, the DiskService#delete_prefixed method passed blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker‑controlled or specially crafted glob characters, the method may delete unintended files from the storage directory. This results in loss of data and can disrupt application availability, representing a moderate-severity vulnerability (CWE‑22 and CWE‑74).

The vulnerability affects Ruby on Rails’ Active Storage component in all releases before Rails 7.2.3.1, 8.0.4.1, and 8.1.2.1. Affected installations include any Rails application that uses the unpatched DiskService for local file storage, regardless of deployment environment.

The CVSS score of 6.6 indicates moderate severity. EPSS is below 1 %, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need access to the application’s API or upload functionality to supply a malicious blob key, implying a remote or locally authenticated attack vector depending on exposure. If successful, the attacker could delete arbitrary files within the storage directory, compromising data integrity and potentially isolating application functionality.