DEBIAN-CVE-2026-126186: High severity debian/rails vulnerability
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :minimagick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the .avs extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading to remote code execution in the FFmpeg process. ImageMagick selects its coders and delegates from the extension in the same way. An application is affected if it accepts uploads from untrusted users and analyzes video or audio attachments, generates video previews, or processes images with ImageMagick. The AviSynth attack additionally requires an FFmpeg built with --enable-avisynth and the AviSynthPlus runtime on the host. Upstream FFmpeg and the common Linux distribution and Homebrew packages do not enable it; the GPL builds distributed for Windows and Linux from ffmpeg.org do. Other decoders that FFmpeg or ImageMagick select from the extension may be reachable without AviSynth. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which deployments are exposed?
An application is affected if it accepts uploads from untrusted users and analyzes video or audio attachments, generates video previews, or processes images with ImageMagick through the :mini_magick variant processor. The issue applies to Active Storage versions before 8.1.4.1 and 8.0.5.2.
What does an attacker need to control?
The attacker needs to be able to upload a file and control its filename and declared content type. This allows them to influence the extension used for the temporary file processed by ffprobe, ffmpeg, or ImageMagick.
When is the FFmpeg impact particularly severe?
If FFmpeg was built with AviSynth support, an uploaded file using the .avs extension can be treated as an AviSynth script. This may disclose files readable by the application process through a preview image, and may permit native-library loading if the attacker can also upload a library.
What can be done before updating?
Prevent untrusted uploads from reaching video or audio analysis, video preview generation, and affected ImageMagick processing paths. Prioritize systems where uploaded files can be named by users and are subsequently passed to ffprobe, ffmpeg, or ImageMagick.
How can I determine whether my application is affected?
Check whether the application uses an Active Storage release earlier than 8.1.4.1 or 8.0.5.2, accepts untrusted uploads, and invokes the listed analyzers, previewer, or ImageMagick processor. For FFmpeg-specific script execution risk, also determine whether the installed FFmpeg includes AviSynth support.