CVE-2026-126186

Name of the Vulnerable Software and Affected Versions activestorage versions prior to 8.0.5.2 activestorage versions 8.1 through 8.1.4.0

Description ActiveStorage::Blob#open writes a blob to a tempfile using the extension of the uploaded filename. This path is then passed to ffprobe (used by VideoAnalyzer and AudioAnalyzer), ffmpeg (used by VideoPreviewer), and ImageMagick (used by ImageAnalyzer via the :mini magick variant processor). Because these tools may select a decoder based on the file extension when the content format is not self-identifying, an attacker can control which decoder processes the upload by manipulating the filename and declared content type.

For instance, if FFmpeg is built with AviSynth support, a file with a .avs extension is treated as an AviSynth script. This can lead to the disclosure of files readable by the application process or the loading of a malicious native library, potentially resulting in remote code execution within the FFmpeg process. ImageMagick similarly selects coders and delegates based on the extension.

Recommendations Update activestorage to version 8.0.5.2 or later. Update activestorage to version 8.1.4.1 or later. As a temporary workaround, remove ActiveStorage::Previewer::VideoPreviewer from config.active storage.previewers, and remove ActiveStorage::Analyzer::VideoAnalyzer and ActiveStorage::Analyzer::AudioAnalyzer from config.active storage.analyzers to stop FFmpeg from running on uploaded files. If the environment uses an FFmpeg build with AviSynth support, rotate all secrets readable by the application process, including secret key base, the master key, config/credentials.yml.enc contents, Active Storage service credentials, database credentials, and third-party service tokens.