# CVE-2026-126188: Active Storage: Possible local file disclosure in video previews and analysis

Source: https://junglewise.ai/threats/cve-2026-126188-active-storage-makes-it-simple-to-upload-and-reference-files-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126188 · Severity: low · CVSS 3.7 · Published 2026-11-11

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/* or audio/* content type for an HLS playlist. FFmpeg content probing selects the hls demuxer, which opens attacker-named file:// segments when the blob is previewed or analyzed. Applications that accept untrusted uploads and generate video previews or analyze video or audio attachments can disclose a local media file readable by the application process when the attacker knows its path. This issue is fixed in versions 8.0.5.2 and 8.1.4.1.

Technologies: [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126188 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126188 being exploited in the wild.

**How severe is CVE-2026-126188?** Low severity, with a CVSS score of 3.7, published 11 November 2026.

**Which products and versions are affected?** activestorage (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.

**Is there a fix for CVE-2026-126188?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-126188?** Check whether you run activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- activestorage (RubyGems) >= 8.1.0.beta1, < 8.1.4.1

## Identifiers

- CVE-2026-126188
- GHSA-3f4q-8x5m-76v8

## Related threats

- [Ruby on Rails Active Storage arbitrary file read and RCE in media processing](https://junglewise.ai/threats/cve-2026-126186-active-storage-possible-arbitrary-file-read-and-remote-code)
- [Ruby on Rails Active Storage content length bypass in Google Cloud Storage uploads](https://junglewise.ai/threats/cve-2026-126085-active-storage-possible-circumvention-of-file-size-limits-in)
- [Ruby on Rails Active Storage GCS signature bypass](https://junglewise.ai/threats/cve-2026-126084-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Rails Active Storage persistent DoS via NUL byte filename](https://junglewise.ai/threats/cve-2026-126074-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Ruby on Rails Active Storage denial of service via stream error handling](https://junglewise.ai/threats/cve-2026-126071-active-storage-makes-it-simple-to-upload-and-reference-files-in)