[GHSA] GHSA-pmwx-rm49-xv39 (low) — ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

GHSA-pmwx-rm49-xv39 Severity: low CVE: None

ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

### Summary

Active Record Tenanted's override of Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allo