CVE-2020-8162

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

• CWE-602
• CWE-434

• https://groups.google.com/g/rubyonrails-security/c/PjU3946mreQMailing List, Patch, Third Party Advisory
• https://hackerone.com/reports/789579Exploit, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4766Third Party Advisory
• https://groups.google.com/g/rubyonrails-security/c/PjU3946mreQMailing List, Patch, Third Party Advisory
• https://hackerone.com/reports/789579Exploit, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4766Third Party Advisory

Published

Jun 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8156A missing verification of the TLS host in Nextcloud Mail 1.1…7
• CVE-2020-8157UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and C…6.8
• CVE-2020-8158Prototype pollution vulnerability in the TypeORM package < 0…9.8
• CVE-2020-8159There is a vulnerability in actionpack_page-caching gem < v1…9.8
• CVE-2020-8160MendixSSO <= 2.1.1 contains endpoints that make use of the o…6.1
• CVE-2020-8161A directory traversal vulnerability exists in rack < 2.2.0 t…8.6
• CVE-2020-8163The is a code injection vulnerability in versions of Rails p…8.8
• CVE-2020-8164A deserialization of untrusted data vulnerability exists in …7.5
• CVE-2020-8165A deserialization of untrusted data vulnernerability exists …9.8
• CVE-2020-8166A CSRF forgery vulnerability exists in rails < 5.2.5, rails …4.3
• CVE-2020-8167A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs modu…6.5
• CVE-2020-8168We have recently released new version of AirMax AirOS firmwa…8.8