{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/active-storage--8.0.5.2--8.1.0.beta1--8.1.4.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:ruby:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-126186"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Active Storage (\u003c 8.0.5.2, \u003e= 8.1.0.beta1 \u003c 8.1.4.1)"],"_cs_severities":["high"],"_cs_tags":["rails","rce","file-read","active-storage"],"_cs_type":"advisory","_cs_vendors":["Ruby on Rails"],"content_html":"\u003cp\u003eActive Storage is vulnerable to arbitrary file read and potential remote code execution due to the insecure handling of temporary files. When processing video or audio attachments, Active Storage creates temporary files that retain the extension provided by the user. External processing tools (FFmpeg, ImageMagick) use these extensions to determine the decoder or delegate if the content itself is ambiguous. An attacker can craft a file with a specific extension (e.g., .avs for AviSynth) to force processing engines to treat the file as a script or library, leading to local file disclosure or RCE within the context of the processing tool.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an application using Active Storage that accepts file uploads and performs automatic attachment analysis or preview generation.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious file (e.g., an AviSynth script) and assigns it an extension corresponding to a target processing delegate (e.g., .avs).\u003c/li\u003e\n\u003cli\u003eThe attacker uploads the file to the application.\u003c/li\u003e\n\u003cli\u003eActive Storage writes the file to a temporary location while preserving the attacker-provided extension.\u003c/li\u003e\n\u003cli\u003eThe application triggers background processing (FFmpeg or ImageMagick) on the file.\u003c/li\u003e\n\u003cli\u003eThe processing tool detects the file extension and interprets the content according to the associated decoder or library (e.g., executing the AviSynth script).\u003c/li\u003e\n\u003cli\u003eThe process either discloses local sensitive files (if the script reads them) or executes arbitrary native code if a malicious library is loaded.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in the unauthorized disclosure of sensitive files readable by the application process (e.g., database credentials, master keys) or remote code execution within the FFmpeg or ImageMagick processing context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eactivestorage\u003c/code\u003e to version 8.0.5.2 or 8.1.4.1 immediately.\u003c/li\u003e\n\u003cli\u003eIf an upgrade is not immediately possible, remove \u003ccode\u003eActiveStorage::Previewer::VideoPreviewer\u003c/code\u003e and the \u003ccode\u003eVideoAnalyzer\u003c/code\u003e/\u003ccode\u003eAudioAnalyzer\u003c/code\u003e from the \u003ccode\u003econfig.active_storage\u003c/code\u003e configuration to disable affected processing.\u003c/li\u003e\n\u003cli\u003eIf the application environment included FFmpeg built with \u003ccode\u003e--enable-avisynth\u003c/code\u003e, consider all application secrets (including \u003ccode\u003esecret_key_base\u003c/code\u003e, database credentials, and service tokens) as potentially compromised; rotate these secrets immediately after patching.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T07:27:40Z","date_published":"2026-11-11T07:27:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-active-storage-rce/","summary":"Ruby on Rails Active Storage is vulnerable to arbitrary file read and potential remote code execution because it uses user-supplied file extensions to determine how external processing tools like FFmpeg and ImageMagick handle uploaded attachments.","title":"Ruby on Rails Active Storage: Arbitrary file read and remote code execution (CVE-2026-126186)","url":"https://feed.craftedsignal.io/briefs/2026-11-active-storage-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Active Storage (\u003c 8.0.5.2, \u003e= 8.1.0.beta1 \u003c 8.1.4.1)","version":"https://jsonfeed.org/version/1.1"}