CVE-2026-126186

### Impact `ActiveStorage::Blob#open` writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to `ffprobe` (`VideoAnalyzer`, `AudioAnalyzer`), `ffmpeg` (`VideoPreviewer`) and ImageMagick (`ImageAnalyzer`, the `:mini_magick` variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the `.avs` extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading to remote code execution in the FFmpeg process. ImageMagick selects its coders and delegates from the extension in the same way. ### Details The fixed releases keep the uploaded extension on the tempfile only when Marcel maps that extension to the blob's recorded content type, and name the tempfile with no extension otherwise. A form upload whose Rack tempfile fails the same check is copied to a correctly named tempfile before processing. Files whose uploaded extension disagrees with their content type are still processed; the external tool detects their format from the content. The Active Storage CHANGELOG describes the change. ### Affected applications An application is affected if it meets all of these requirements: - Accepts uploads from untrusted users. - Analyzes video or audio attachments (which Active Storage does on attach by default), generates video previews, or processes images with ImageMagick. The AviSynth attack additionally requires an FFmpeg built with `--enable-avisynth` and the AviSynthPlus runtime on the host. Upstream FFmpeg and the common Linux distribution and Homebrew packages do not enable it; the GPL builds distributed for Windows and Linux from ffmpeg.