CVE-2026-126188: 
Ruby vulnerability analysis and mitigation

CVE-2026-126188 is a local file disclosure vulnerability in Ruby on Rails' Active Storage component, specifically affecting ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer. These components pass uploaded blob contents to FFmpeg without restricting the demuxer, allowing a crafted HLS playlist uploaded with a video/* or audio/* content type to cause FFmpeg to open attacker-specified file:// segments during preview or analysis. Affected versions are Rails < 8.0.5.2 and >= 8.1, < 8.1.4.1. It carries a CVSS v3.1 base score of 3.7 (Low), and was disclosed on November 4, 2026 via GitHub Security Advisory GHSA-3f4q-8x5m-76v8 and assigned CVE-2026-126188 on November 11, 2026 (GitHub Advisory, Feedly).

The root cause is improper restriction of FFmpeg's demuxer selection (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). Active Storage's direct upload mechanism preserves the client-declared content type, so an attacker can upload an HLS playlist (.m3u8) while declaring it as video/* or audio/*. When the blob is previewed or analyzed, FFmpeg probes the file content and selects the hls demuxer, which then opens file:// URIs named within the playlist — effectively reading local files accessible to the application process. The fix introduces a -format_whitelist argument passed to every ffmpeg/ffprobe invocation, controlled by the new config.active_storage.ffmpeg_allowed_formats setting (defaulting to common containers like mov, matroska, mp3, wav, etc.), preventing the HLS demuxer from being selected (GitHub Advisory, Patch 8.1, Patch 8.0).

Successful exploitation allows an unauthenticated attacker to disclose the contents of local media files readable by the Rails application process, provided the attacker knows the file path. The impact is limited to confidentiality — there is no integrity or availability impact. The scope is constrained to files accessible by the application process, but sensitive configuration files, credentials, or private media stored on the server could be exposed if their paths are known or guessable (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity — the attacker must know the path of a target local file and the application must accept untrusted uploads and trigger video preview or audio analysis on them. The vulnerability was responsibly disclosed by HackerOne researcher w3rmut (GitHub Advisory, Feedly).

1. Identify a target application: Locate a Rails application (version < 8.0.5.2 or >= 8.1, < 8.1.4.1) that accepts untrusted file uploads and uses Active Storage with video preview or audio/video analysis enabled.
2. Craft a malicious HLS playlist: Create an .m3u8 file referencing a known local file path via a file:// URI, for example:

   #EXTM3U
   #EXT-X-TARGETDURATION:10
   #EXTINF:10,
   file:///etc/passwd
   #EXT-X-ENDLIST

3. Upload with a spoofed content type: Perform a direct upload of the .m3u8 file while declaring the content type as video/mp4 or audio/mpeg to bypass content-type validation and retain the declared type in the blob record.
4. Trigger preview or analysis: Cause the application to generate a video preview or run audio/video analysis on the uploaded blob (e.g., by attaching it to a record that triggers analysis, or by requesting a preview URL).
5. Retrieve disclosed file contents: The HLS demuxer instructs FFmpeg to open the file:// segment, and the resulting preview image or stored metadata may contain or reflect contents of the targeted local file, which the attacker can then retrieve (GitHub Advisory, Patch 8.1).

• File System: Uploaded blobs with .m3u8 extensions or HLS playlist content stored under video/* or audio/* content types in the Active Storage blob store.
• Logs: Rails application logs showing ActiveStorage::PreviewError or ffprobe/ffmpeg warnings referencing unexpected file paths; on unpatched systems, absence of such errors when processing .m3u8 uploads may indicate successful exploitation. After patching, log entries such as "Video analysis failed because ffprobe exited with status 1" or "Audio analysis failed because ffprobe exited with status 1" indicate a blocked attempt.
• Network: Unusual upload requests where the declared Content-Type is video/* or audio/* but the file content matches an HLS playlist (text beginning with #EXTM3U).
• Database: Active Storage blob records where content_type is video/* or audio/* but the associated file data is a text-based M3U8 playlist rather than a binary media container (GitHub Advisory, Patch 8.1).

Upgrade to Rails 8.0.5.2 or 8.1.4.1, which introduce the -format_whitelist FFmpeg argument via the new config.active_storage.ffmpeg_allowed_formats setting, restricting demuxer selection to common safe formats (Rails 8.0.5.2 Release, Rails 8.1.4.1 Release). For applications that cannot upgrade immediately, the official workaround is to remove the vulnerable components from the Active Storage configuration:

config.active_storage.previewers -= [ActiveStorage::Previewer::VideoPreviewer]
config.active_storage.analyzers -= [ActiveStorage::Analyzer::VideoAnalyzer, ActiveStorage::Analyzer::AudioAnalyzer]

This disables video preview generation and audio/video metadata analysis entirely. Patch files for in-place application are available for 8.1 and 8.0 (GitHub Advisory).