Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Critical Rails flaw exposes files, risks RCE via CVE-2026-66066

Part of the CVE-2026-66066 story · since 30 Jul

Quiet for 8 weekslast report 31 Aug7 articles4 outlets
30 Jul · SecurityOnline first16 Sep2 OctNowThis article1st of 7
  • Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066. This article, 1st of 7.
  • Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
  • Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
  • Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
  • Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
  • Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
  • Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.

A critical vulnerability in Ruby on Rails Active Storage, tracked as CVE-2026-66066, has been identified, allowing unauthenticated attackers to read arbitrary files, potentially leading to remote code execution. Rated 9.5 on the CVSS scale, this flaw arises from improper handling of the libvips image processor. Rails apps using versions below 7.2.3.2, 8.0.5.1, or 8.1.3.1, and accepting untrusted image uploads, are affected. Users are urged to upgrade to secure versions immediately and rotate application secrets. Researchers have not yet reported any exploitation of this vulnerability in the wild.

How the story developed

All 7 articles
Quiet for 8 weekslast report 31 Aug7 articles4 outlets

7 articles from 4 outlets since 30 Jul. Quiet since 31 Aug. This was the first report.

Now30 Jul1 Aug3431First reportSecurityOnline · 30 Jul, 04:31Picked up againafter 4 weeks quiet
  • Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066. This article, 1st of 7.
  • Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
  • Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
  • Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
  • Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
  • Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
  • Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Thu 30 JulDay 02
    1. Critical Rails flaw exposes files, risks RCE via CVE-2026-6606604:31 · SecurityOnline · First report · This article, 1st of 7
    2. Critical Ruby on Rails Bug Exposes Files via Image Upload16:59 · Rapid7

  2. Quiet for 2 days

    Sat 1 AugDay 22
    1. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public11:25 · SecurityOnline
    2. Ruby on Rails Patches Critical Vulnerability11:25 · SecurityWeek

  3. Quiet for 2 days

    Mon 3 AugDay 42
    1. Ruby on Rails fixes critical Active Storage bug CVE-2026-6606607:26 · Security Affairs
    2. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails19:21 · Rapid7

  4. Quiet for 4 weeks

    Mon 31 AugDay 321
    1. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution11:29 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in