Possible Path Traversal in Active Record Tenanted Gem
An early warning has been issued regarding a possible path traversal vulnerability in the Active Record Tenanted gem. This vulnerability, tracked as GHSA-PMWX-RM49-XV39, could potentially allow reading, writing, or deleting arbitrary files on the server if a blob key containing path traversal sequences is used.
What happened
The vulnerability reportedly lies in Active Record Tenanted's override of Active Storage's `DiskService#path_for`, which does not validate that the resolved filesystem path remains within the storage root directory. This lack of validation appears to enable the path traversal attack.
To assess your exposure, check if your application uses the Active Record Tenanted gem. If so, it is under investigation whether versions prior to 0.7.0 are vulnerable. The recommended action is to upgrade to Active Record Tenanted v0.7.0 or later.
For more detailed information, consult the primary source at [GHSA-pmwx-rm49-xv39](https://github.com/basecamp/activerecord-tenanted/security/advisories/GHSA-pmwx-rm49-xv39). The exact versions affected and further technical details should be obtained from this source.
How 0Day mitigates this
active_record_tenanted is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.