ACTIVESTORAGE · GHSA-3w93-6hmw-whh4 · Package
FIX → 8.1.4.1 +1
When an Active Storage GCS service has the cache_control option set, direct-upload URLs are signed with V4, which does not cover Content-Type or Content-MD5. A client can upload an object with a chosen content type, such as HTML, that GCS may then serve from the bucket path on storage.googleapis.com.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use the Active Storage GCS service with cache_control configured and that accept direct uploads from clients. GCS services without cache_control sign with V2 and are not affected.
Not affected if no-cache-control-option, no-direct-uploads, non-gcs-storage
Who cares activestorage, gcs, rails, ruby
Gemfile.lock for activestorage, against the affected rangesconfig/storage.yml for a GCS service that sets cache_controlUpgrade to 8.1.4.1 +1
When a GCS service is configured with the cache_control option, ActiveStorage::Service::GCSService#url_for_direct_upload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the response-content-type that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on storage.googleapis.com. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bucket path and read or replace a victim's later responses for signed URLs in that bucket.
Applications that use the GCS service with cache_control configured and accept direct uploads are affected. GCS services without cache_control sign with V2 and are not affected.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
activestorage 8.1.x: move to 8.1.4.1activestorage 8.0.x: move to 8.0.5.2cache_control option from the GCS service configurationThe fixed releases sign every GCS direct-upload URL with V2, which binds an empty Content-Type and the declared Content-MD5. The configured Cache-Control is still returned by headers_for_direct_upload and sent by the client, but it is no longer part of the signature, and direct-upload URLs for these services are no longer limited to V4's seven-day maximum expiry. See the Active Storage CHANGELOG.
Removing the cache_control option from the GCS service configuration makes Active Storage sign direct uploads with V2.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher thepo1es.