Ruby on Rails Active Storage: Arbitrary file read and remote code execution (CVE-2026-126186)

Active Storage is vulnerable to arbitrary file read and potential remote code execution due to the insecure handling of temporary files. When processing video or audio attachments, Active Storage creates temporary files that retain the extension provided by the user. External processing tools (FFmpeg, ImageMagick) use these extensions to determine the decoder or delegate if the content itself is ambiguous. An attacker can craft a file with a specific extension (e.g., .avs for AviSynth) to force processing engines to treat the file as a script or library, leading to local file disclosure or RCE within the context of the processing tool.

Attack Chain

1. An attacker identifies an application using Active Storage that accepts file uploads and performs automatic attachment analysis or preview generation.
2. The attacker crafts a malicious file (e.g., an AviSynth script) and assigns it an extension corresponding to a target processing delegate (e.g., .avs).
3. The attacker uploads the file to the application.
4. Active Storage writes the file to a temporary location while preserving the attacker-provided extension.
5. The application triggers background processing (FFmpeg or ImageMagick) on the file.
6. The processing tool detects the file extension and interprets the content according to the associated decoder or library (e.g., executing the AviSynth script).
7. The process either discloses local sensitive files (if the script reads them) or executes arbitrary native code if a malicious library is loaded.

Impact

Successful exploitation may result in the unauthorized disclosure of sensitive files readable by the application process (e.g., database credentials, master keys) or remote code execution within the FFmpeg or ImageMagick processing context.

Recommendation

• Upgrade activestorage to version 8.0.5.2 or 8.1.4.1 immediately.
• If an upgrade is not immediately possible, remove ActiveStorage::Previewer::VideoPreviewer and the VideoAnalyzer/AudioAnalyzer from the config.active_storage configuration to disable affected processing.
• If the application environment included FFmpeg built with --enable-avisynth, consider all application secrets (including secret_key_base, database credentials, and service tokens) as potentially compromised; rotate these secrets immediately after patching.