{"action":"Upgrade activerecord-tenanted to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"activerecord-tenanted","cve_ids":[],"ecosystem":"RubyGems","exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-pmwx-rm49-xv39","id":"tcs_01M5KEMNMKPC24AT2KZW7HY047","modified_at":"2026-07-29T17:15:32.416429356Z","published_at":"2026-07-29T17:06:00Z","references":["https://osv.dev/vulnerability/GHSA-pmwx-rm49-xv39","https://github.com/basecamp/activerecord-tenanted/security/advisories/GHSA-pmwx-rm49-xv39","https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87","https://github.com/basecamp/activerecord-tenanted/pull/307","https://github.com/basecamp/activerecord-tenanted/commit/b242c8ad9bf58bbd7f5a032d153b0f29db54b9ba","https://github.com/basecamp/activerecord-tenanted","https://github.com/basecamp/activerecord-tenanted/releases/tag/v0.7.0"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-pmwx-rm49-xv39","url":"https://osv.dev/vulnerability/GHSA-pmwx-rm49-xv39"}],"summary":"ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal"}