Is CVE-2026-126186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126186 being exploited in the wild.

How severe is CVE-2026-126186?

High severity, with a CVSS score of 8.8, published 10 November 2026.

Which products and versions are affected?

Rails Active Storage = 8.1 = 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

How is CVE-2026-126186 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126186?

Check whether you run Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126186: Ruby on Rails Active Storage arbitrary file read and RCE in media processing

Q: Is there a fix for CVE-2026-126186?

Yes. activestorage (RubyGems): upgrade to 8.1.4.1 or later. Until then: Applications that cannot upgrade immediately can remove ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer from the respective configuration entries to disable FFmpeg processing. Using FFmpeg built without AviSynth support blocks the AviSynth attack but not other extension-selected decoder exploits from ImageMagick. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126186 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126186?

Check whether you run Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126186 · Severity: high · CVSS 8.8 · Published 2026-11-10

Ruby on Rails Active Storage is a file attachment system used by many web applications. When processing uploaded video, audio, or image files, it passes them to external tools (FFmpeg, ImageMagick) based on the filename extension rather than the actual file content. An attacker who uploads a malicious file with a deceptive extension can trick these tools into executing code or reading sensitive files, potentially compromising the entire application and its secrets.

Technologies: activestorage (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126186 being exploited in the wild.
How severe is CVE-2026-126186?: High severity, with a CVSS score of 8.8, published 10 November 2026.
Which products and versions are affected?: Rails Active Storage < 8.0.5.2 and >= 8.1 < 8.1.4.1; activestorage (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.
Is there a fix for CVE-2026-126186?: Yes. activestorage (RubyGems): upgrade to 8.1.4.1 or later. Until then: Applications that cannot upgrade immediately can remove ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer from the respective configuration entries to disable FFmpeg processing. Using FFmpeg built without AviSynth support blocks the AviSynth attack but not other extension-selected decoder exploits from ImageMagick. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126186 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126186?: Check whether you run Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

activestorage (RubyGems): upgrade to 8.1.4.1 or later
```
bundle update activestorage
```

Applications that cannot upgrade immediately can remove ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer from the respective configuration entries to disable FFmpeg processing. Using FFmpeg built without AviSynth support blocks the AviSynth attack but not other extension-selected decoder exploits from ImageMagick.

Technical details

The vulnerability exists in ActiveStorage::Blob#open, which creates temporary files retaining the uploaded filename's extension regardless of the declared content type. FFmpeg (especially with AviSynth support) and ImageMagick select decoders/codecs based on file extension, allowing an attacker to control which decoder processes a file. An AviSynth script with a .avs extension can be evaluated by FFmpeg, disclosing readable files or loading malicious native libraries for RCE; other decoders may also be exploitable. The fix validates the extension against the recorded content type via Marcel and strips extensions from mismatched files before processing.

Affected products

Rails Active Storage < 8.0.5.2 and >= 8.1 < 8.1.4.1

Identifiers

CVE-2026-126186
GHSA-v924-7rp8-4mxh

Timeline

2026-11-10: disclosed: Advisory published
2026-11-10: patched: Fixed versions released

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.