cve.bz

CVE-2026-126085

5.3 mediumFix available

Medium (5.3) in rails rails. Fixed in activestorage 8.0.5.2, 8.1.4.1.

On this page
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
CWE-602 Client-Side Enforcement of Server-Side Security
OWASP Top 10
A06:2025 Insecure Design
Published
Assigned by
GitHub_M (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-126085 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-126085?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-126085?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-126085 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
rails>= 8.1, < 8.1.4.1
rails< 8.0.5.2

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-hfr4-8rjc-97m2RubyGemsactivestorage>=8.1.0.beta1 <8.1.4.18.1.4.1
GHSA-hfr4-8rjc-97m2RubyGemsactivestorage<8.0.5.28.0.5.2

Attack patterns (CAPEC)

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits. More on the page of CWE-602 (12).

References

Check your stackJSON