CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips मनमाना फ़ाइल पठन → SECRETKEYBASE चोरी → RCE अवलोकन CVE-2026-66066 Ruby on Rails Active Storage में एक गंभीर-स्तर CVSS 9.5 प्री-ऑथेंटिकेशन मनमाना फ़ाइल पठन से रिमोट कोड निष्पादन श्रृंखला है, जो Rails 7.2.0–7.2.3.1 , 8.0.0–8.0.5 , और...

CVE-2026-66066-POC

PoC for CVE-2026-66066 - Minimal stock Rails/libvips lab This repository reproduces the Rails Active Storage file-read-to-RCE chain described by GHSA-xr9x-r78c-5hrm against Rails 8.1.3, the newest affected Rails 8.1 release. Rails 8.1.3.1 is the patched control. Use it only in the disposable loca...

CVE-2019-5420

CVE-2019-5420 CVE-2019-5420 Ruby on Rails केवल शैक्षिक उद्देश्यों के लिए। विवरण के लिए Reference देखें। पर्यावरण Ruby: 2.6.0p0 Rails: 5.2.2 चलाएँ root@kitploit: $ docker run --name cve-2019-5420 --rm -p 3000:3000 knqyf263/cve-2019-5420 एक्सप्लॉइट touch /tmp/rce निष्पादित करें root@kitploit: $ cur...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell أداة PoC لقراءة الملفات العشوائية → تنفيذ الأوامر عن بُعد RCE بشكل شرطي عبر Active Storage + libvips في Ruby on Rails. ملف واحد، Python 3.11+، مكتبة قياسية خالصة بدون أي تبعيات ، مع حمولات هجينة MAT/HDF5 مدمجة، ومفكك ترميز بكسلات PNG خالص بلغة Python، وقراءة...

CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell استغلال تنفيذ التعليمات البرمجية عن بُعد RCE قبل المصادقة في Ruby on Rails Active Storage مستودع بحث تعليمي في مجال أمن المعلومات لثغرة CVE-2026-66066 "KindaRails2Shell". هذا المستودع مُخصّص لأغراض البحث الأمني، وتحليل الثغرات، والكشف، والأغراض الدفاعية فقط. 📖...

KindaRails2Shell

KindaRails2Shell: CVE-2026-66066 Un proof of concept sans dépendance, monofichier, et un laboratoire Docker limité au loopback pour la vulnérabilité de lecture arbitraire de fichiers dans Rails Active Storage/libvips. Il démontre également l'escalade conditionnelle décrite dans l'avis de sécurité...

rails-forensics-CVE-2026-66066

rails-forensics-CVE-2026-66066 Tooling and method for answering two questions about a Rails application and CVE-2026-66066, the Active Storage and libvips arbitrary file read known as KindaRails2Shell: 1. Was I vulnerable, and for how long? 2. Was I exploited, and if so, what left the building? T...

CVE-2026-45378

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

CVE-2026-45378

CVE-2026-45378 affects Decidim where the identity-document verification admin UI embeds verification_attachment blobs using reusable signed Active Storage disk URLs. The implementation renders images with variant_url(...), producing signed /rails/active_storage/disk/... links that bypass authoriz...

CVE-2026-45378 Decidim: Verification documents can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...

Arbitrary File Read

Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

Exploit for CVE-2026-66066

KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...

CVE-2026-66066

A flaw was found in Active Storage, a component of Action Pack. An unauthenticated attacker can exploit this vulnerability by crafting a malicious file upload. This allows the attacker to invoke unsafe libvips operations, leading to the ability to read arbitrary files on the system including...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...