CVE-2026-126186: 
Ruby vulnerability analysis and mitigation

CVE-2026-126186 is a file extension reliance vulnerability in Rails Active Storage that enables arbitrary file read and remote code execution (RCE) via video previews, audio analysis, and image processing. It affects activestorage versions < 8.0.5.2 and >= 8.1, < 8.1.4.1. The vulnerability was responsibly disclosed by HackerOne researcher pirikara and published on November 10, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is classified under CWE-646 (Reliance on File Name or Extension of Externally-Supplied File) and CWE-641 (Improper Restriction of Names for Files and Other Resources). ActiveStorage::Blob#open writes uploaded blobs to tempfiles whose names include the original uploaded filename's extension, then passes those paths to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer), and ImageMagick (ImageAnalyzer, :mini_magick variant processor). These tools select decoders based on file extension when content does not self-identify its format — meaning an attacker who controls the filename and declared content type can force processing by an unintended decoder. The most severe vector involves FFmpeg built with --enable-avisynth: uploading a file named attack.avs declared as video/mp4 causes ffprobe/ffmpeg to evaluate it as an AviSynth script (e.g., Import("/etc/passwd")), potentially disclosing readable files via preview images or loading an attacker-uploaded native library for RCE. ImageMagick is similarly susceptible to extension-driven coder/delegate selection (GitHub Advisory, Patch 8.1).

Successful exploitation allows an authenticated attacker with file upload access to achieve arbitrary file read (disclosing secrets such as secret_key_base, database credentials, cloud storage credentials, and third-party API tokens readable by the application process) or remote code execution within the FFmpeg or ImageMagick process. The confidentiality, integrity, and availability impacts are all rated High. Applications that have already been exploited should treat all secrets readable by the application process as compromised and rotate them immediately, including secret_key_base, master key, config/credentials.yml.enc contents, Active Storage service credentials, and database credentials (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is reported as 0.0, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires low privileges (an authenticated user with upload access) and no user interaction, but the most severe AviSynth-based RCE path additionally requires the target server to run an FFmpeg build compiled with --enable-avisynth and the AviSynthPlus runtime — a configuration not present in upstream FFmpeg or common Linux distribution packages, though it is present in the GPL builds distributed from ffmpeg.org for Windows and Linux (GitHub Advisory).

1. Reconnaissance: Identify a Rails application (activestorage < 8.0.5.2 or >= 8.1, < 8.1.4.1) that accepts file uploads from authenticated users and performs video/audio analysis, video preview generation, or ImageMagick image processing.
2. Authenticate: Obtain a low-privilege account on the target application with file upload capability.
3. Craft malicious file: Create a file with AviSynth script content designed to read sensitive files, e.g., Import("/etc/passwd") or to load a native library. Name the file attack.avs.
4. Declare mismatched content type: Upload the crafted file with the filename attack.avs but declare the content type as video/mp4 (or another media type that triggers Active Storage analysis/preview).
5. Trigger processing: Active Storage's Blob#open writes the file to a tempfile named with the .avs extension. When ffprobe or ffmpeg processes the tempfile, the AviSynth demuxer is selected based on the .avs extension and the script is evaluated.
6. Exfiltrate data or achieve RCE: The AviSynth script execution can embed the contents of readable files (e.g., /etc/passwd, credentials files) into the generated preview image, which the attacker retrieves, or load an attacker-uploaded native library to achieve code execution in the FFmpeg process (GitHub Advisory, Patch 8.1).

• File System: Tempfiles in the system temp directory (e.g., /tmp/) with names matching ActiveStorage-<blob_id>-*.avs or other unexpected extensions that do not correspond to the declared content type; unexpected native libraries (.so, .dll) uploaded to Active Storage blob storage.
• Logs: Application logs showing Active Storage blob processing for files with .avs, .m3u, or other script-capable extensions declared with mismatched content types (e.g., video/mp4); ffprobe or ffmpeg error/warning messages referencing AviSynth or unexpected demuxers; ImageMagick logs referencing unexpected coders or delegates.
• Process: Unexpected child processes spawned by ffmpeg or ffprobe (e.g., shell commands, file reads); ffmpeg or ImageMagick processes accessing sensitive system files such as /etc/passwd, credential files, or application secrets.
• Network: Outbound connections from the application server to attacker-controlled hosts originating from ffmpeg or ImageMagick processes (in RCE scenarios involving library loading) (GitHub Advisory).

Upgrade to the patched versions: activestorage 8.0.5.2 or 8.1.4.1. The fix validates that the uploaded file's extension matches the blob's recorded content type (via Marcel) before retaining it on the tempfile; otherwise, the tempfile is created with no extension, preventing extension-based decoder selection (Rails 8.0.5.2 Release, Rails 8.1.4.1 Release). For those unable to upgrade immediately, patches are available: 8.1 patch and 8.0 patch. As a workaround, remove ActiveStorage::Previewer::VideoPreviewer from config.active_storage.previewers and ActiveStorage::Analyzer::VideoAnalyzer and ActiveStorage::Analyzer::AudioAnalyzer from config.active_storage.analyzers to prevent FFmpeg from running on uploads. Running FFmpeg without AviSynth support (--enable-avisynth not set) closes the AviSynth-specific attack vector but does not fully mitigate extension-based decoder selection in ImageMagick. Applications that may have been exploited should rotate all secrets readable by the application process (GitHub Advisory).

The vulnerability was published by Rails maintainer Mike Dalessio (flavorjones) as part of a broader Rails security release that addressed over a dozen CVEs simultaneously. The release received positive community reactions on GitHub, with users reacting with 👍, 🎉, ❤️, and 🚀 emojis on the release notes. The Hacker Wire noted the advisory on Mastodon shortly after publication. Red Hat has tracked the issue via Bugzilla (Red Hat Bugzilla) and their CVE advisory page (Red Hat CVE). GitLab also published an advisory for the affected gem (GitLab Advisory).