Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects.
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Ruby on Rails
- Product
- rails
- CVSS v3.1
- 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Fix
- available
- Weakness
- CWE-248
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 28 (Notable)
- CVSS v3.1 4.3 medium
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-126074 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.