CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Published: 7/30/2026Modified: 8/1/2026

Related Intelligence (4)

CRITICALVulnerability

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066 , an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are < 7.2.3.2 , >= 8.0, < 8.0.5.1 , and >= 8.1, < 8.1.3.1 . Vips is the default Active Storage variant processor for applications that load Rails 7.0

CVE-2026-66066
Rapid7
CRITICALVulnerability

KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066 , a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classified as Initialization of a Resource with an Insecure Default ( CWE-1188 ). An unauthenticated attacker

CVE-2026-66066
Rapid7
MEDIUMVulnerability

KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)

[object Object]

CVE-2026-66066
r/netsec
CRITICALVulnerability

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

CVE-2026-66066
The Hacker News

References (12)

https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1ehttps://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49ahttps://github.com/rails/rails/releases/tag/v7.2.3.2https://github.com/rails/rails/releases/tag/v8.0.5.1https://github.com/rails/rails/releases/tag/v8.1.3.1https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrmhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.ymlhttps://thehackernews.com/2026/07/critical-rails-flaw-could-let.htmlhttp://www.openwall.com/lists/oss-security/2026/07/29/9http://www.openwall.com/lists/oss-security/2026/08/01/6https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066