Rails 7.2.x Release Notes

Notes

• This release contains no functional change from the OSS Rails v7.2.3.1.

Security Fixes

Action View

• CVE-2026-33168 — Fix possible XSS vulnerability in tag helpers.

Active Storage

• CVE-2026-33658 - Fix possible DoS vulnerability in proxy mode via multi-range requests.
• CVE-2026-33202 — Fix possible glob injection in DiskService.
• CVE-2026-33195 — Fix possible path traversal in DiskService.
• CVE-2026-33174 - Fix possible DoS vulnerability in proxy mode via Range requests.
• CVE-2026-33173 — Fix insufficient filtering of metadata in direct uploads.

Active Support

• CVE-2026-33176 — Fix possible DoS vulnerability in number helpers.
• CVE-2026-33170 — Fix possible XSS vulnerability in SafeBuffer#%.
• CVE-2026-33169 — Fix possible ReDoS vulnerability in number_to_delimited.