GHSA-P2PM-G2H6-7J5J Active Storage: Possible DoS vulnerability in Active Storage filename handling

Impact ActiveStorage::Filenamebase and extensionwithdelimiter, and therefore extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is...

Active Storage: Possible DoS vulnerability in Active Storage filename handling

Impact ActiveStorage::Filenamebase and extensionwithdelimiter, and therefore extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is...

EUVD-2026-122910

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filenamebase and extensionwithdelimiter, and therefore extension, pass the stored filename unmodified to File.basename and...

CVE-2026-126074

The Active Storage component in Rails (prior to versions 8.1.4.1 and 8.0.5.2 ) is vulnerable to a persistent Denial of Service (DoS) . The root cause is that ActiveStorage::Filename#base and #extension_with_delimiter pass client-supplied filenames containing NUL bytes unmodified to File.basename ...