Every CVE Search/ Get API key

CVE-2026-66066

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

9.5 CriticalPublic exploitFix available

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

30.1%Up 28.4 points since Jul 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.5

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Record
CVE-2026-66066
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-1188
Updated
2026-11-02
EUVDEUVD-2026-51270 9.5

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Record
EUVD-2026-51270
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-xr9x-r78c-5hrm 9.5

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact

In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret_key_base and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.

Details

libvips reads and writes file formats through "loaders" and "savers" (or more generally "operations"), many of which are backed by third-party libraries. It marks some of these operations as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats unrelated to web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload a crafted file and cause a variant to be generated from it may be able to invoke one.

We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application. One specific attack chain has been reported to us (see "Disclosure" below), but we do not assume it is the only one that exists.

Affected applications

An application is affected if it meets all of these requirements:

  • Uses libvips for Active Storage image processing. This is config.active_storage.variant_processor = :vips, which load_defaults 7.0 set and no later default has changed.
  • Allows image uploads from untrusted users.

Generating variants is not a separate requirement.

Mitigation

  • Upgrade to a fixed version of activestorage.
  • The minimum version of libvips must be upgraded to >= 8.13.
  • Change secret_key_base and change any secrets accessible in the application environment (see "Expire and change secrets" below)

Earlier versions of libvips (< 8.13) cannot disable unfuzzed operations at all, and Active Storage will raise an exception during boot in such an unsecurable environment.

Expire and change secrets

Upgrading closes the vulnerability but does not undo an exfiltrated secret if that already occurred. An affected application should treat every secret readable by the application process as potentially exposed and change it, including:

  • secret_key_base
  • The master key, whether stored in config/master.key or supplied as RAILS_MASTER_KEY, along with everything in config/credentials.yml.enc that it decrypts
  • Credentials for the Active Storage service, such as S3, GCS, or Azure keys
  • Database credentials
  • Tokens and keys for any third-party service the application calls

Changing secret_key_base expires active sessions and requires users to log in again. Encrypted cookies, signed cookies, signed global IDs, and Active Storage URLs are also affected.

Rotation should only be used as an intermediate step if necessary. Do not retain an exposed secret as a fallback.

Workarounds

If libvips < 8.13 is being used, there are no workarounds available other than removing the dependency on libvips from the application. Some applications may have ruby-vips declared as a dependency only for image analysis, and those applications may be able to simply remove ruby-vips from the Gemfile to remove libvips from the application. Applications that do not use Active Storage can remove ruby-vips from the Gemfile to avoid the boot-time checks.

If libvips >= 8.13 is present on the system, applications can disable the unfuzzed operations without upgrading Rails by setting the VIPS_BLOCK_UNTRUSTED environment variable, which libvips reads while initializing.

Applications also running ruby-vips >= 2.2.1 or later can instead call Vips.block_untrusted(true) from an initializer.

Releases

The fixed releases are available at the normal locations.

Versions affected

  • activestorage < 7.2.3.2
  • activestorage >= 8.0, < 8.0.5.1
  • activestorage >= 8.1, < 8.1.3.1

Disclosure

Technical details of the attack…

Record
GHSA-xr9x-r78c-5hrm
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-1188
Updated
2026-11-02
NVD 9.5

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Record
CVE-2026-66066
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-1188
Updated
2026-11-02
OSV 9.5

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Record
CVE-2026-66066
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-1188
Updated
2026-11-02
OSVDEBIAN-CVE-2026-66066 9.5

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Record
DEBIAN-CVE-2026-66066
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-xr9x-r78c-5hrm 9.5

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact

In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret_key_base and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.

Details

libvips reads and writes file formats through "loaders" and "savers" (or more generally "operations"), many of which are backed by third-party libraries. It marks some of these operations as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats unrelated to web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload a crafted file and cause a variant to be generated from it may be able to invoke one.

We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application. One specific attack chain has been reported to us (see "Disclosure" below), but we do not assume it is the only one that exists.

Affected applications

An application is affected if it meets all of these requirements:

  • Uses libvips for Active Storage image processing. This is config.active_storage.variant_processor = :vips, which load_defaults 7.0 set and no later default has changed.
  • Allows image uploads from untrusted users.

Generating variants is not a separate requirement.

Mitigation

  • Upgrade to a fixed version of activestorage.
  • The minimum version of libvips must be upgraded to >= 8.13.
  • Change secret_key_base and change any secrets accessible in the application environment (see "Expire and change secrets" below)

Earlier versions of libvips (< 8.13) cannot disable unfuzzed operations at all, and Active Storage will raise an exception during boot in such an unsecurable environment.

Expire and change secrets

Upgrading closes the vulnerability but does not undo an exfiltrated secret if that already occurred. An affected application should treat every secret readable by the application process as potentially exposed and change it, including:

  • secret_key_base
  • The master key, whether stored in config/master.key or supplied as RAILS_MASTER_KEY, along with everything in config/credentials.yml.enc that it decrypts
  • Credentials for the Active Storage service, such as S3, GCS, or Azure keys
  • Database credentials
  • Tokens and keys for any third-party service the application calls

Changing secret_key_base expires active sessions and requires users to log in again. Encrypted cookies, signed cookies, signed global IDs, and Active Storage URLs are also affected.

Rotation should only be used as an intermediate step if necessary. Do not retain an exposed secret as a fallback.

Workarounds

If libvips < 8.13 is being used, there are no workarounds available other than removing the dependency on libvips from the application. Some applications may have ruby-vips declared as a dependency only for image analysis, and those applications may be able to simply remove ruby-vips from the Gemfile to remove libvips from the application. Applications that do not use Active Storage can remove ruby-vips from the Gemfile to avoid the boot-time checks.

If libvips >= 8.13 is present on the system, applications can disable the unfuzzed operations without upgrading Rails by setting the VIPS_BLOCK_UNTRUSTED environment variable, which libvips reads while initializing.

Applications also running ruby-vips >= 2.2.1 or later can instead call Vips.block_untrusted(true) from an initializer.

Releases

The fixed releases are available at the normal locations.

Versions affected

  • activestorage < 7.2.3.2
  • activestorage >= 8.0, < 8.0.5.1
  • activestorage >= 8.1, < 8.1.3.1

Disclosure

Technical details of the attack…

Record
GHSA-xr9x-r78c-5hrm
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-1188
Updated
2026-11-02
OSVUBUNTU-CVE-2026-66066 9.5

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Record
UBUNTU-CVE-2026-66066
CVSS 4.0
9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:12153-1 No score

hawk2-2.7.2+git.1792148770.648dcddb-1.1 on GA media

These are all security issues fixed in the hawk2-2.7.2+git.1792148770.648dcddb-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12153-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22068-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
openSUSE-SU-2026:22068-1
Updated
2026-11-02
OSVSUSE-SU-2026:24195-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
SUSE-SU-2026:24195-1
Updated
2026-11-02
OSVSUSE-SU-2026:24250-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
SUSE-SU-2026:24250-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
activestorage
RubyGems
 before 7.2.3.2
7.2.3.2
activestorage
RubyGems
 8.0.0.beta1 up to 8.0.5.1
8.0.5.1
activestorage
RubyGems
 8.1.0.beta1 up to 8.1.3.1
8.1.3.1
rails
Debian:12
 before 2:6.1.7.10+dfsg-1~deb12u3, plus listed versions
2:6.1.7.10+dfsg-1~deb12u12:6.1.7.10+dfsg-1~deb12u22:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-11
Show 12 moreShow less
2:6.1.7.3+dfsg-122:6.1.7.3+dfsg-132:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u3
rails
Debian:13
 before 2:7.2.2.2+dfsg-2~deb13u2, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-12:7.2.2.2+dfsg-2~deb13u1
2:7.2.2.2+dfsg-2~deb13u2
rails
Debian:14
 before 2:7.2.3.2+dfsg-1, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-12:7.2.2.2+dfsg-22:7.2.2.2+dfsg-2~deb13u12:7.2.2.2+dfsg-2~deb13u2
Show 4 moreShow less
2:7.2.3+dfsg-12:7.2.3+dfsg-22:7.2.3+dfsg-32:7.2.3.1+dfsg-1
2:7.2.3.2+dfsg-1
activestorage
RubyGems
 before 7.2.3.2, plus listed versions
0.15.2.05.2.0.beta15.2.0.beta25.2.0.rc1
Show 45 moreShow less
5.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.5
7.2.3.2
activestorage
RubyGems
 8.0.0.beta1 up to 8.0.5.1, plus listed versions
8.0.08.0.0.18.0.0.rc18.0.0.rc28.0.1
Show 6 moreShow less
8.0.28.0.2.18.0.38.0.48.0.4.18.0.5
8.0.5.1
activestorage
RubyGems
 8.1.0.beta1 up to 8.1.3.1, plus listed versions
8.1.08.1.0.rc18.1.18.1.28.1.2.18.1.3
8.1.3.1
hawk2
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
hawk2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1
rails
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2
 None known
rails
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2
 None known
rails
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1
 None known
rails
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1
 None known
rails
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3
 None known
rails
Ubuntu:26.10
 All versions, plus listed versions
2:7.2.3+dfsg-22:7.2.3.2+dfsg-2
 None known
rails
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2
 None known
hawk2
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 2.7.2+git.1792148770.648dcddb-1.1
2.7.2+git.1792148770.648dcddb-1.1
hawk2
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub0xBlackash/CVE-2026-660662026-07-29
PoC in GitHubZer0SumGam3/CVE-2026-66066-POC2026-07-29
MetasploitRuby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution2026-07-29
PoC in GitHubrails/rails-forensics-CVE-2026-660662026-07-30
PoC in GitHub0xsha/KindaRails2Shell2026-07-31
PoC in GitHubHackSpeak/CVE-2026-660662026-08-03
PoC in GitHubshinthink/CVE-2026-660662026-08-04
PoC in GitHubivanesk315/CVE-2026-660662026-09-10

History

History
RecordedChangedSources
affected, exploits, facts
first indexedCVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-66066 is a critical vulnerability (CVSS 9.5) in Rails, published July 30, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 30.1%, the 98th percentile. Fixed in activestorage 7.2.3.2.

References

Show 33 moreShow less
This page doesn't list everything

Left out here: 112 versions and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open