4578 matches found
Exploit for CVE-2026-66066
KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...
Ruby on Rails Active Storage CVE-2026-66066 Detection Tool
A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...
CVE-2026-66066
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...
KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classifi...
Exploit for CVE-2026-66066
🚨 CVE-2026-66066 — KindaRails2Shell Pre-Authenticatio...
GHSA-PP92-CRG2-GFV9 vulnerabilities
Vulnerabilities for packages: ruby3.3-oauth2, gitlab-rails-ce-fips, gitlab-rails-ce, ruby4.0-oauth2, ruby3.2-oauth2, ruby3.4-oauth2...
CVE-2026-54603 vulnerabilities
Vulnerabilities for packages: ruby3.3-oauth2, gitlab-rails-ce-fips, gitlab-rails-ce, ruby4.0-oauth2, ruby3.2-oauth2, ruby3.4-oauth2...
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 CVSS score: 9.5, the flaw can expose the Rails process environment and secre...
Exploit for CVE-2026-66066
rails-activestorage-vips-audit An Agent Skillhttps://agent...
Possible arbitrary file read and remote code execution in Active Storage variant processing
Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...
PT-2026-65864
Name of the Vulnerable Software and Affected Versions Ruby on Rails affected versions not specified Description An issue exists in applications using Active Storage with Vips that allows unauthenticated attackers to read server files by uploading crafted images. This could lead to the exposure of...
CVE-2026-13311 vulnerabilities
Vulnerabilities for packages: arangodb, gitlab-rails-ce, gitlab-rails-ce-fips, gemini-cli, code-server...
GHSA-395F-4HP3-45GV vulnerabilities
Vulnerabilities for packages: arangodb, gitlab-rails-ce, gitlab-rails-ce-fips, gemini-cli, code-server...
CVE-2026-61666 vulnerabilities
Vulnerabilities for packages: pghero-fips, pghero, gitlab-rails-ce, ruby4.0-rails...
GHSA-2X63-GW47-W4MM vulnerabilities
Vulnerabilities for packages: pghero-fips, pghero, gitlab-rails-ce, ruby4.0-rails...
GHSA-8WHX-365G-H9VV vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby4.0-rails...
GHSA-5QHF-9PHG-95M2 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby4.0-rails...
GHSA-9WJQ-CP2P-HRGF vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby4.0-rails...