UBUNTU-CVE-2026-126188: Medium severity ubuntu/rails vulnerability
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/ or audio/ content type for an HLS playlist. FFmpeg content probing selects the hls demuxer, which opens attacker-named file:// segments when the blob is previewed or analyzed. Applications that accept untrusted uploads and generate video previews or analyze video or audio attachments can disclose a local media file readable by the application process when the attacker knows its path. This issue is fixed in versions 8.0.5.2 and 8.1.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.0.5.2 - Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.1.4.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they accept untrusted direct uploads and use Active Storage to generate video previews or analyze video or audio attachments. Exploitation depends on the uploaded blob retaining an attacker-controlled video/* or audio/* content type for an HLS playlist.
What does an attacker need to exploit it?
An attacker needs to upload a crafted HLS playlist through a direct upload path and know the filesystem path of a local media file readable by the application process. When the blob is previewed or analyzed, FFmpeg can open attacker-named file:// segments.
What information can be disclosed?
The issue can disclose a local media file that is readable by the application process. The available data does not indicate disclosure of files that the process cannot read.
What versions contain the fix?
The issue is fixed in Active Storage versions 8.0.5.2 and 8.1.4.1. The affected ranges are versions before 8.0.5.2 and versions from 8.1 through before 8.1.4.1.