Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-66066: Rails Active Storage may expose files and allow code execution
CVE-2026-66066 · published 3 months ago
Summary
Versions of Rails before the latest patches that use Active Storage with the libvips image library can be tricked into processing a malicious upload. This can let an unauthenticated attacker read any file the Rails process can access, including secret keys, and possibly run code on the server. Upgrade Rails to the newest released version to close the issue.
What to do
- Update david heinemeier hansson activestorage to version 7.2.3.2.
- Update david heinemeier hansson activestorage to version 8.0.5.1.
- Update david heinemeier hansson activestorage to version 8.1.3.1.
- Update debian rails to version 2:7.2.3.2+dfsg-1.
- Update debian rails to version 2:7.2.2.2+dfsg-2~deb13u2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | david heinemeier hansson | activestorage |
< 7.2.3.2 >= 8.0.0.beta1, < 8.0.5.1 >= 8.1.0.beta1, < 8.1.3.1 Fix: upgrade to 7.2.3.2
|
| Ubuntu:Pro:16.04:LTS | canonical | rails | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | rails | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | rails | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | rails | All versions |
| Ubuntu:24.04:LTS | canonical | rails | All versions |
| Ubuntu:26.04:LTS | canonical | rails | All versions |
| – | rails | rails | < 7.2.3.2 |
| Debian:11 | debian | rails | All versions |
| Debian:12 | debian | rails | All versions |
| Debian:13 | debian | rails |
< 2:7.2.2.2+dfsg-2~deb13u2 Fix: upgrade to 2:7.2.2.2+dfsg-2~deb13u2
|
| Debian:14 | debian | rails |
< 2:7.2.3.2+dfsg-1 Fix: upgrade to 2:7.2.3.2+dfsg-1
|
Original advisory text
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.
References
- https://security-tracker.debian.org/tracker/CVE-2026-66066 Vendor Advisory
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066
- https://github.com/advisories/GHSA-xr9x-r78c-5hrm
- https://ubuntu.com/security/CVE-2026-66066 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-66066 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66066... Vendor Advisory
- https://github.com/rails/rails/releases/tag/v8.0.5.1 URL
- http://www.openwall.com/lists/oss-security/2026/08/01/6 URL
- https://github.com/rails/rails/releases/tag/v8.1.3.1 URL
- http://www.openwall.com/lists/oss-security/2026/07/29/9 URL
- https://github.com/rails/rails-forensics-CVE-2026-66066 Exploit
- https://github.com/rails/rails/releases/tag/v7.2.3.2 URL
- https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e Patch
- https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066 URL
- https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5 Patch
- https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a Patch
- https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html URL
- https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm Vendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66066 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published30 Jul 2026
Updated29 Oct 2026
First seen30 Jul 2026
Sources
DEBIAN-CVE-2026-66066 · OSV
UBUNTU-CVE-2026-66066 · OSV
CVE-2026-66066 · MITRE
GHSA-xr9x-r78c-5hrm · GHSA
CVE-2026-66066 · OSV
CVE-2026-66066 · NVD
Track software like this
Free during beta