ETK-2026-3520Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3520",
  "cve_id": null,
  "display_id": "ETK-2026-3520",
  "ghsa_id": "GHSA-v924-7rp8-4mxh",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Unsafe extension-based decoder selection in Active Storage",
  "summary": "Affected Active Storage releases can pass untrusted upload filenames to external media or image processors in a way that influences decoder selection. In applications that accept untrusted uploads and analyze media, create video previews, or use ImageMagick, this may expose files readable by the application and, in certain AviSynth-enabled FFmpeg deployments, may permit code execution in the FFmpeg process.",
  "mitigation": "Upgrade activestorage to 8.1.4.1 or 8.0.5.2. Until upgraded, disable Active Storage video previewing and audio/video analysis for untrusted uploads, and restrict untrusted upload processing where possible.",
  "vendor": "rubygems",
  "product": "rubygems:activestorage",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.1, < 8.1.4.1"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.1.4.1"
      ],
      "package_name": "activestorage",
      "purl": "pkg:gem/activestorage"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 8.0.5.2"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.0.5.2"
      ],
      "package_name": "activestorage",
      "purl": "pkg:gem/activestorage"
    }
  ],
  "cwes": [
    646
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 8.625206983333333,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-11-04T16:54:47.416961+00:00",
      "days": -0.1716030974074074,
      "is_lower_bound": true,
      "measured_at": "2026-11-04T21:01:53.962075+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T03:02:13+00:00",
      "days": -0.7497792196412038,
      "is_lower_bound": true,
      "measured_at": "2026-11-04T21:01:53.962075+00:00",
      "url": "https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh"
    }
  }
}