Rails Active Storage: File read and code execution via tempfile extension
Summary
Active Storage keeps the uploaded filename's extension on the temporary file it hands to ffprobe, ffmpeg and ImageMagick. These tools pick a decoder from the extension, so an uploader who controls the filename can select the decoder. The AviSynth path can read files the application process can access or load an uploaded native library, which may lead to code execution in the FFmpeg process; other extension-selected decoders may be reachable without AviSynth. The attack requires an application that accepts untrusted uploads and analyzes video or audio, generates video previews, or processes images with ImageMagick.
Affected
- Rails 8.1 before 8.1.4.1
- Rails 8.0 before 8.0.5.2
- Older versions: Unknown.
Fixed in
- activestorage 8.1.4.1
- activestorage 8.0.5.2
Workaround
- Disable video and audio analysis and video previews for untrusted uploads.
- Stop accepting untrusted uploads, or remove ffmpeg, ffprobe and ImageMagick from hosts where they are not needed.
- No other vendor workaround is confirmed. Unknown.
Exploitation
- No known exploitation in the wild at the time of publication.
- Not listed in CISA KEV.
- Public proof of concept: Unknown.
Our recommendation
- Identify Rails applications running activestorage below 8.1.4.1 or 8.0.5.2, and plan an upgrade for any Rails 7.x applications, as no fix is available for them.
- Upgrade to 8.1.4.1 or 8.0.5.2 together with the ImageMagick fix GHSA-f3w6-w445-fwh9.
- Check whether untrusted uploads reach analysis or previews, and whether any Windows host runs a GPL FFmpeg build with AviSynth.
- If exposure is suspected, rotate secret_key_base and cloud storage credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub security advisory GHSA-v924-7rp8-4mxh github.com
- Fix commit 72136ff (tempfile extension) github.com
- Fix commit 8106938 (tempfile extension) github.com
- Rails release v8.1.4.1 github.com
- Rails release v8.0.5.2 github.com
- CVE description (Strix) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:38.
Original description (NVD)
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :mini_magick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the .avs extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading to remote code execution in the FFmpeg process. ImageMagick selects its coders and delegates from the extension in the same way. An application is affected if it accepts uploads from untrusted users and analyzes video or audio attachments, generates video previews, or processes images with ImageMagick. The AviSynth attack additionally requires an FFmpeg built with --enable-avisynth and the AviSynthPlus runtime on the host. Upstream FFmpeg and the common Linux distribution and Homebrew packages do not enable it; the GPL builds distributed for Windows and Linux from ffmpeg.org do. Other decoders that FFmpeg or ImageMagick select from the extension may be reachable without AviSynth. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e
- https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.