Hoch 8.8Linux-Server
CVE-2026-126186
activestorage: Active Storage: Remote code execution via unsafe file extension handling in media processing
activestorage
### Impact `ActiveStorage::Blob#open` writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to `ffprobe` (`VideoAnalyzer`, `AudioAnalyzer`), `ffmpeg` (`VideoPreviewer`) and ImageMagick (`ImageAnalyzer`, the `:mini_magick` variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an…
10. Nov 2026
Original bei Red Hat öffnen