NUL Byte Vulnerability in Active Storage from Rails
CVE-2026-126074

4.3MEDIUM

Key Information:

Vendor

Rails

Status
Rails
Vendor
CVE Published:
10 November 2026

What is CVE-2026-126074?

Active Storage, a framework used for uploading and referencing files in cloud-based services, has a vulnerability related to its handling of filenames. In versions prior to 8.1.4.1 and 8.0.5.2, filenames containing a NUL byte can trigger an ArgumentError due to the unmodified processing of user-supplied filenames in methods such as #base and #extension_with_delimiter. This issue poses a risk of a persistent denial of service (DoS) on applications using SQLite or MySQL/MariaDB, causing errors during blob processing and rendering until the filename is corrected. Applications leveraging PostgreSQL are not subject to this issue as it rejects the problematic row. Ensure to upgrade to the patched versions to mitigate this vulnerability.

Affected Version(s)

rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1

rails < 8.0.5.2 < 8.0.5.2

References

https://github.com/rails/rails/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/rails/rails/commit/60f22af88b71eae251f...
x_refsource_MISC
https://github.com/rails/rails/commit/9b0d4bef2211a2c08ca...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.