Threats tagged 'ghsa-3f4q-8x5m-76v8'

Active Storage versions before 8.1.4.1 and 8.0.5.2 allow local file disclosure via video previews and analysis. The vulnerability arises because FFmpeg tools run on uploaded blobs without restricting input formats, enabling crafted HLS playlists to cause disclosure of local media files accessible by the application process. This affects applications accepting untrusted uploads and generating video previews or media metadata using FFmpeg. Fixed releases restrict FFmpeg to allowed formats via configuration. Workarounds include disabling video and audio previewers and analyzers.