UBUNTU-CVE-2026-126074: SQL Injection
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filename#base and #extensionwithdelimiter, and therefore #extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it as an Action Text attachment then raises, possibly resulting in a persistent DoS vulnerability for the pages that display the blob until it is purged or its filename is corrected. Applications that use PostgreSQL are not affected, because PostgreSQL rejects the row. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which deployments are realistically affected?
Applications using vulnerable Active Storage versions with SQLite or MySQL/MariaDB can be affected if they allow users to upload attachments. PostgreSQL-backed applications are not affected because PostgreSQL rejects strings containing NUL bytes.
What access does an attacker need?
An attacker needs permission to upload an attachment with a filename containing a NUL byte. The filename is stored verbatim, allowing the problematic blob to persist where the database accepts the value.
Does exploitation affect every request?
The failure occurs on requests that build a variant or preview, open the blob, or render it as an Action Text attachment. Pages displaying the affected blob can remain unavailable until the blob is purged or its filename is corrected.
What can be done before upgrading?
Purge blobs with NUL-containing filenames or correct their stored filenames to restore affected pages. The issue is fixed in Active Storage versions 8.1.4.1 and 8.0.5.2.