CVE-2026-126074

A flaw was found in Active Storage. A user permitted to upload file attachments can supply a filename containing a null byte, which is stored without proper sanitization. Subsequent application requests that attempt to view, preview, or process the uploaded attachment fail with an unhandled error...