CVE-2026-66066
published 2026-07-30CVE-2026-66066: Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable…
PriorityP186critical9.5CVSS 4.0
AVNACLATPPRNUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
2.10%
80.9th percentile
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rails | activestorage | >= 0 < 7.2.3.2 | 7.2.3.2 |
| rails | activestorage | >= 8.0.0.beta1 < 8.0.5.1 | 8.0.5.1 |
| rails | activestorage | >= 8.1.0.beta1 < 8.1.3.1 | 8.1.3.1 |
| rails | rails | < 7.2.3.2 | 7.2.3.2 |
| rails | rails | — | — |
| rails | rails | — | — |
CVSS provenance
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.5CRITICAL
vendor_redhat9.5CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Rails prior 7.2.3.2/8.0.5.1/8.1.3.1 Active Storage unrestricted upload
vuldb·2026-07-30·CVSS 9.5
CVE-2026-66066 [CRITICAL] Rails prior 7.2.3.2/8.0.5.1/8.1.3.1 Active Storage unrestricted upload
A vulnerability was found in Rails. It has been classified as critical. The affected element is an unknown function of the component Active Storage. This manipulation causes unrestricted upload.
This vulnerability is tracked as CVE-2026-66066. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
ghsa·2026-07-30
CVE-2026-66066 [CRITICAL] CWE-1188 Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
### Impact
In its default configuration, a Rails application that displays image variants may allow an
unauthenticated attacker to read arbitrary files from the server, including the process environment.
That environment typically holds `secret_key_base` and often credentials for external systems, which
may in turn allow escalation to remote code execution or lateral movement to those systems.
### Details
libvips reads and writes file formats through "loaders" and "savers" (or more generally
"operations"), many of which are backed by third-party libraries. It marks some of these operations
as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats u
VulnCheck
rubyonrails rails Initialization of a Resource with an Insecure Default
vulncheck·2026·CVSS 9.5
CVE-2026-66066 [CRITICAL] rubyonrails rails Initialization of a Resource with an Insecure Default
rubyonrails rails Initialization of a Resource with an Insecure Default
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0
Red Hat
activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations
vendor_redhat·2026-07-30·CVSS 9.5
CVE-2026-66066 [CRITICAL] CWE-434 activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations
activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations
A flaw was found in Active Storage, a component of Action Pack. An unauthenticated attacker can exploit this vulnerability by crafting a malicious file upload. This allows the attacker to invoke unsafe `libvips` operations, leading to the ability to read arbitrary files on the system including sensitive environment variables and application secrets. The exposure of these credentials could enable remote code execution or lateral movement within the affected system.
Statement: This Important flaw in Active Storage allows unauthenticated remote attackers to read arbitrary files and potentially achieve remote code execution. This occurs in applications configured with `libvips` as the Active Storage variant pr
No detection rules found.
Hackernews
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
blogs_hackernews·2026-09-01·CVSS 9.8
CVE-2026-0768 [CRITICAL] Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck.
The vulnerabilities in question are listed below -
CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user.
CVE-2026-66066 aka KindaRails2Shell (CVSS score: 9.5) - A vulnerability that could allow an unauthenticated attacker to read arbitrary files from the server, leak Rails p
Checkpoint
3rd August – Threat Intelligence Report
blogs_checkpoint·2026-08-03
CVE-2026-59726 3rd August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 27th July, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Minnesota IT Services has confirmed coordinated cyberattacks affecting more than 30 community water utilities across the state. The incidents briefly disrupted a treatment plant in Braham and affected industrial control systems. Officials reported that drinking water safety was not affected. While the attack was not officially attributed, federa
Rapid7
Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
blogs_rapid7·2026-08-03·CVSS 9.5
CVE-2026-66066 [CRITICAL] Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
## Overview
On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066 , an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, Target file bytes are returned as image pixels
## Analysis
The published chain contains two separate trust failures. Rails decides that a blob is an image from a database value, while libvips decides what parser to use from the bytes on disk. Once the file reaches matload , libvips and libmatio disagree again about the same MAT header. libvips only looks at the first ten bytes, while libmatio selects the MAT version from bytes 124 and 125.
## Article Tags
Rapid7 Analysis
Emergent Threat Response
Labs
Hackernews
⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
blogs_hackernews·2026-08-03
CVE-2026-42897 ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
This week kept coming back to permission. A model crossed a boundary. A wallet trusted bad randomness. Webmail kept an intruder around. Public systems, package feeds, hotel networks, and login flows all gave away more than intended.
Some of it was clever. Most of it was just access left lying around: old bugs, exposed gear, poisoned dependencies, weak defaults, and tooling that moved from forum chatter to real targets.
The full weekly recap report follows.
## ⚡ Threat of the Week
Anthropic Disclosed its Models Targeted 3 O
Rapid7
KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
blogs_rapid7·2026-07-30·CVSS 9.5
CVE-2026-66066 [CRITICAL] KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
## Overview
On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066 , a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classified as Initialization of a Resource with an Insecure Default ( CWE-1188 ). An unauthenticated attacker may be able to leverage CVE-2026-66066 and read files accessible to the Rails application process, potentially exposing secrets that could enable remote code execution (RCE) or access to connected systems.
An application is affected when it uses libvips for Active Storage image processing and accepts image uploads from untrusted users. Rails notes that generating image variants is not a separ
Hackernews
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
blogs_hackernews·2026-07-29
CVE-2026-66066 Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.
CVE-2026-66066
secret_key_base
load_defaults 7.0
Ethiack and GMO Flatt Security list the affected ranges as Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. Rails 6.0.0 through 6.1.7.10 releases are affected only when Active Storage is configured to use Vips, which was not the default processor in Rails
Bugzilla
CVE-2026-66066 activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations
bugzilla·2026-07-30·CVSS 9.5
CVE-2026-66066 [CRITICAL] CVE-2026-66066 activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations
CVE-2026-66066 activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixe
https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1ehttps://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49ahttps://github.com/rails/rails/releases/tag/v7.2.3.2https://github.com/rails/rails/releases/tag/v8.0.5.1https://github.com/rails/rails/releases/tag/v8.1.3.1https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrmhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.ymlhttps://thehackernews.com/2026/07/critical-rails-flaw-could-let.htmlhttp://www.openwall.com/lists/oss-security/2026/07/29/9http://www.openwall.com/lists/oss-security/2026/08/01/6https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066https://github.com/rails/rails-forensics-CVE-2026-66066
2026-07-30
Published
Exploited in the wild