# CVE-2026-126186: Ruby on Rails Active Storage arbitrary file read and RCE in media processing

Source: https://junglewise.ai/threats/cve-2026-126186-active-storage-possible-arbitrary-file-read-and-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126186 · Severity: high · CVSS 8.8 · Published 2026-11-10

Ruby on Rails Active Storage is a file attachment system used by many web applications. When processing uploaded video, audio, or image files, it passes them to external tools (FFmpeg, ImageMagick) based on the filename extension rather than the actual file content. An attacker who uploads a malicious file with a deceptive extension can trick these tools into executing code or reading sensitive files, potentially compromising the entire application and its secrets.

Technologies: [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage). Vendors: [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126186 being exploited in the wild.

**How severe is CVE-2026-126186?** High severity, with a CVSS score of 8.8, published 10 November 2026.

**Which products and versions are affected?** Rails Active Storage < 8.0.5.2 and >= 8.1 < 8.1.4.1; activestorage (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

**Is there a fix for CVE-2026-126186?** Yes. activestorage (RubyGems): upgrade to 8.1.4.1 or later. Until then: Applications that cannot upgrade immediately can remove ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer from the respective configuration entries to disable FFmpeg processing. Using FFmpeg built without AviSynth support blocks the AviSynth attack but not other extension-selected decoder exploits from ImageMagick. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126186 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126186?** Check whether you run Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- activestorage (RubyGems): upgrade to 8.1.4.1 or later

  ```sh
  bundle update activestorage
  ```


Applications that cannot upgrade immediately can remove ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer from the respective configuration entries to disable FFmpeg processing. Using FFmpeg built without AviSynth support blocks the AviSynth attack but not other extension-selected decoder exploits from ImageMagick.

## Technical details

The vulnerability exists in ActiveStorage::Blob#open, which creates temporary files retaining the uploaded filename's extension regardless of the declared content type. FFmpeg (especially with AviSynth support) and ImageMagick select decoders/codecs based on file extension, allowing an attacker to control which decoder processes a file. An AviSynth script with a .avs extension can be evaluated by FFmpeg, disclosing readable files or loading malicious native libraries for RCE; other decoders may also be exploitable. The fix validates the extension against the recorded content type via Marcel and strips extensions from mismatched files before processing.

## Affected products

- Rails Active Storage < 8.0.5.2 and >= 8.1 < 8.1.4.1

## Identifiers

- CVE-2026-126186
- GHSA-v924-7rp8-4mxh

## Timeline

- 2026-11-10: disclosed: Advisory published
- 2026-11-10: patched: Fixed versions released

## Related threats

- [Active Storage: Possible local file disclosure in video previews and analysis](https://junglewise.ai/threats/cve-2026-126188-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Ruby on Rails Active Storage content length bypass in Google Cloud Storage uploads](https://junglewise.ai/threats/cve-2026-126085-active-storage-possible-circumvention-of-file-size-limits-in)
- [Ruby on Rails Active Storage GCS signature bypass](https://junglewise.ai/threats/cve-2026-126084-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Rails Active Storage persistent DoS via NUL byte filename](https://junglewise.ai/threats/cve-2026-126074-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Ruby on Rails Active Storage denial of service via stream error handling](https://junglewise.ai/threats/cve-2026-126071-active-storage-makes-it-simple-to-upload-and-reference-files-in)