GHSA-35PC-QWV6-4858 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

CVE-2026-6336 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

CVE-2026-12436 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

GHSA-94P8-87FF-W336 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

CVE-2026-4672 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

CVE-2026-14351 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

GHSA-2RC9-8CX9-FXPR vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

GHSA-8JC8-CVQJ-P926 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng, gitlab-cng-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips...

K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066

Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...

CVE-2026-66066 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, pghero, ruby3.3-rails, pghero-fips, gitlab-rails-ce-fips...

GHSA-XR9X-R78C-5HRM vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, pghero, ruby3.3-rails, pghero-fips, gitlab-rails-ce-fips...

Exploit for CVE-2026-66066

KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classifi...

Exploit for CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell Pre-Authenticatio...

GHSA-PP92-CRG2-GFV9 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.3-oauth2, ruby3.4-oauth2, ruby3.2-oauth2, ruby4.0-oauth2, gitlab-rails-ce-fips...

CVE-2026-54603 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.3-oauth2, ruby3.4-oauth2, ruby3.2-oauth2, ruby4.0-oauth2, gitlab-rails-ce-fips...

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 CVSS score: 9.5, the flaw can expose the Rails process environment and secre...