{"id":"EM-20261110-WT7O","url":"https://cyber.eventmonitor.net/incident/EM-20261110-WT7O/active-storage-vulnerability-cve-2026-126186/","type":"cve","title":"Active Storage Vulnerability (CVE-2026-126186)","subtitle":"CVE-2026-126186","subject":"CVE-2026-126186","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-10T22:18:31.843Z","firstSignal":"2026-11-10T21:38:55.000Z","lastSignal":"2026-11-10T22:18:31.843Z","updated":"2026-11-10T22:24:45.599Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T22:18:31.843Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-10T22:18:31.843Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T21:38:55.000Z","what":"First signal: C26 GitHub Advisory Database"},{"at":"2026-11-10T22:18:31.843Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261110-WT7O created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T22:18:31.843Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T22:18:31.843Z","detail":"CVSS 8.8"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T21:38:55.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-v924-7rp8-4mxh / CVE-2026-126186: Active Storage: Possible arbitrary file read and remote code execution in video previews, analysis and image processing","text":"rubygems:activestorage, rubygems:activestorage","url":"https://github.com/advisories/GHSA-v924-7rp8-4mxh"},{"at":"2026-11-10T22:18:31.843Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-126186 (CVSS 8.8)","text":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :mini_magick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126186"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T22:18:31.843","score":8.8,"severity":"HIGH","desc":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to…","product":"","seen":1794349485599},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}