Threats tagged 'ghsa-v924-7rp8-4mxh'

Active Storage versions prior to 8.0.5.2 and between 8.1.0.beta1 and 8.1.4.1 are vulnerable to arbitrary file read and potential remote code execution via crafted video previews, analysis, and image processing. The vulnerability arises because the tempfile used for uploaded blobs retains the original file extension, which influences how external tools like FFmpeg and ImageMagick decode the file. An attacker controlling the filename and content type can cause these tools to execute unintended decoders, including AviSynth scripts in FFmpeg builds with AviSynth support, potentially leading to file disclosure or remote code execution. Fixed versions restrict the tempfile extension to those matching the blob's content type, mitigating this risk.