CVE-2026-66066

🗓️ 30 Jul 2026 18:32:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 17 Media mentions👁 311 Views🌐 WEB

Action Pack Active Storage flaw allows arbitrary file read and possible code execution via unsafe libvips on untrusted uploads.

Reporter	Title	Published	Views	Family All 105
GithubExploit	Exploit for CVE-2026-66066	3 Aug 202612:31	–	githubexploit
GithubExploit	Exploit for CVE-2026-66066	29 Jul 202621:08	–	githubexploit
GithubExploit	Exploit for CVE-2026-66066	29 Jul 202620:45	–	githubexploit
GithubExploit	Exploit for CVE-2026-66066	29 Jul 202616:10	–	githubexploit
GithubExploit	Exploit for CVE-2026-66066	10 Sep 202607:17	–	githubexploit
GithubExploit	Exploit for CVE-2026-66066	4 Aug 202602:51	–	githubexploit
GithubExploit	Exploit for CVE-2026-66066	30 Jul 202621:06	–	githubexploit
GithubExploit	Exploit for CVE-2026-66066	31 Jul 202616:51	–	githubexploit
Akamai Blog	CVE-2026-66066: Defending Against the “KindaRails2Shell” Pre-Auth RCE	30 Jul 202608:00	–	akamaiblog
attackerkb	CVE-2026-66066	30 Jul 202618:32	–	attackerkb

Vulners

Node

rubyonrails railsRange<7.2.3.2

rubyonrails railsRange8.0.0.beta1–8.0.5.1

rubyonrails railsRange8.1.0.beta1–8.1.3.1

[
  {
    "vendor": "rails",
    "product": "rails",
    "versions": [
      {
        "version": "< 7.2.3.2",
        "status": "affected"
      },
      {
        "version": ">= 8.0.0.beta1, < 8.0.5.1",
        "status": "affected"
      },
      {
        "version": ">= 8.1.0.beta1, < 8.1.3.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml
github	www.github.com/rails/rails/releases/tag/v7.2.3.2
github	www.github.com/rails/rails/releases/tag/v8.0.5.1
github	www.github.com/rails/rails/releases/tag/v8.1.3.1
github	www.github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e
thehackernews	www.thehackernews.com/2026/07/critical-rails-flaw-could-let.html
github	www.github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a
github	www.github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
openwall	www.openwall.com/lists/oss-security/2026/08/01/6

Parameter	Position	Path	Description	CWE
post[image]	request body	/posts	Arbitrary file read via Rails Active Storage Vips variant processing (CVE-2026-66066) triggered by crafted image upload.	CWE-1188
VARIATION_KEY	request body	/posts	Arbitrary file read via Rails Active Storage Vips variant processing (CVE-2026-66066) triggered by crafted image upload.	CWE-1188
VARIATION_KEY	path	/rails/active_storage/direct_uploads	Arbitrary file read via Active Storage direct upload step with Vips variant, enabling access to environment variables and secrets.	CWE-1188

10 Sep 2026 20:36Current

8.7High risk

Vulners AI Score8.7

CVSS 49.5

EPSS0.27861

SSVC