CVE-2026-126188: Local Media Information Disclosure in Ruby on Rails Active Storage via FFmpeg Demuxer Selection

Vulnerability ID: CVE-2026-126188
CVSS Score: 3.7
Published: 2026-11-12

CVE-2026-126188 (GHSA-3f4q-8x5m-76v8) is an information disclosure vulnerability in the Active Storage component of Ruby on Rails prior to versions 8.0.5.2 and 8.1.4.1. When generating previews or extracting metadata from uploaded media files, Active Storage invokes the external command-line tools ffmpeg and ffprobe without specifying a format whitelist. An attacker who can upload a crafted HTTP Live Streaming (HLS) playlist while declaring a standard video or audio MIME type can cause FFmpeg to engage the HLS demuxer, resolve file:// segment URIs, and disclose visual frames or metadata from local media files readable by the Rails application process.

TL;DR

Active Storage prior to Rails 8.0.5.2 and 8.1.4.1 passes uploaded media files to ffmpeg and ffprobe without the -format_whitelist argument. Attackers can upload an HLS (.m3u8) playlist masquerading as a video or audio file to read local media files via the file:// protocol and leak their contents through generated thumbnail previews or metadata records.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-126188 / GHSA-3f4q-8x5m-76v8
• Weakness Class: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• Affected Component: Active Storage (VideoPreviewer, VideoAnalyzer, AudioAnalyzer)
• Attack Vector: Network (Crafted HLS .m3u8 Direct Upload with file:// Segment URIs)
• CVSS v3.1 Score: 3.7 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
• EPSS Score: 0.28% (20.62nd Percentile)
• Impact: Unauthorized disclosure of local media frames and metadata readable by the Rails process
• Patched Versions: Rails 8.0.5.2, Rails 8.1.4.1

Affected Systems

• Ruby on Rails (activestorage gem) < 8.0.5.2
• Ruby on Rails (activestorage gem) >= 8.1.0, < 8.1.4.1
• activestorage (Ruby on Rails): < 8.0.5.2 (Fixed in: 8.0.5.2)
• activestorage (Ruby on Rails): >= 8.1.0, < 8.1.4.1 (Fixed in: 8.1.4.1)

Code Analysis

Commit: 3b1f262

Enforce -format_whitelist in Active Storage ffmpeg and ffprobe invocations (Rails 8.1 branch)

@@ -382,6 +382,12 @@ module ActiveStorage
   mattr_accessor :video_preview_arguments, default: "-y -vframes 1 -f image2"

+  mattr_accessor :ffmpeg_allowed_formats, default: %w[ mov matroska avi mpeg mpegts flv asf ogg mp3 wav flac aac aiff caf ].freeze
+
+  def self.ffmpeg_format_whitelist_arguments # :nodoc:
+    [ "-format_whitelist", Array(ffmpeg_allowed_formats).join(",") ] unless ffmpeg_allowed_formats.nil?
+  end

Commit: 69aff80

Enforce -format_whitelist in Active Storage ffmpeg and ffprobe invocations (Rails 8.0 branch)

@@ -30,7 +30,7 @@ def preview(**options)
     private
       def draw_relevant_frame_from(file, &block)
-        draw self.class.ffmpeg_path, "-i", file.path, *Shellwords.split(ActiveStorage.video_preview_arguments), "-", &block
+        draw self.class.ffmpeg_path, *ActiveStorage.ffmpeg_format_whitelist_arguments, "-i", file.path, *Shellwords.split(ActiveStorage.video_preview_arguments), "-", &block
       end
   end
 end

Mitigation Strategies

• Enforce a strict container format allowlist (-format_whitelist) whenever invoking ffmpeg or ffprobe on untrusted files to prevent automatic probing of playlist demuxers like HLS.
• Perform server-side binary MIME type identification on uploaded blobs rather than trusting client-declared content_type metadata during direct uploads.
• Store uploaded blobs on isolated object storage services (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage) rather than the local filesystem to minimize the presence of sensitive media files on the application host.

Remediation Steps:

1. Update the Gemfile to specify gem 'rails', '>= 8.0.5.2' (for 8.0.x) or '>= 8.1.4.1' (for 8.1.x).
2. Execute 'bundle update rails activestorage' and redeploy the application.
3. Verify that config.active_storage.ffmpeg_allowed_formats is not set to nil and does not include 'hls' in any environment configuration files.
4. If immediate upgrading is blocked, deploy an initializer that prepends '-format_whitelist' with safe container formats to VideoPreviewer, VideoAnalyzer, and AudioAnalyzer.

References

• GitHub Security Advisory GHSA-3f4q-8x5m-76v8
• NVD Vulnerability Detail: CVE-2026-126188
• CVE.org Record: CVE-2026-126188
• Ruby on Rails Release v8.0.5.2
• Ruby on Rails Release v8.1.4.1
• Official Patch Commit (Rails 8.1 branch)
• Official Patch Commit (Rails 8.0 branch)

Read the full report for CVE-2026-126188 on our website for more details including interactive diagrams and full exploit analysis.