CVE-2026-12436 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-runner, gitlab-cng-fips...

CVE-2026-14351 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-runner, gitlab-cng-fips...

CVE-2026-4672 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-runner, gitlab-cng-fips...

GHSA-2RC9-8CX9-FXPR vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-runner, gitlab-cng-fips...

GHSA-94P8-87FF-W336 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-runner, gitlab-cng-fips...

GHSA-8JC8-CVQJ-P926 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-runner, gitlab-cng-fips...

K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066

Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...

GHSA-XR9X-R78C-5HRM vulnerabilities

Vulnerabilities for packages: pghero, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.3-rails, pghero-fips...

CVE-2026-66066 vulnerabilities

Vulnerabilities for packages: pghero, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.3-rails, pghero-fips...

Exploit for CVE-2026-66066

KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classifi...

Exploit for CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell Pre-Authenticatio...

GHSA-PP92-CRG2-GFV9 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-oauth2, ruby4.0-oauth2, ruby3.3-oauth2, ruby3.2-oauth2...

CVE-2026-54603 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-oauth2, ruby4.0-oauth2, ruby3.3-oauth2, ruby3.2-oauth2...

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 CVSS score: 9.5, the flaw can expose the Rails process environment and secre...

Exploit for CVE-2026-66066

rails-activestorage-vips-audit An Agent Skillhttps://agent...

Possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...