CVE-2020-8162

score

<0.1

cvss

7.5

epss

3.0%

published

2020-06-19

kev added

—

first seen

2026-10-21

Rails < 5.2.4.2 and < 6.0.3.1 contain a client side enforcement bypass in ActiveStorage's S3 adapter caused by allowing end users to modify Content-Length during direct file uploads, letting attackers bypass upload limits, exploit requires attacker to control upload request.