THE Rails Active Storage vulnerability CVE-2026-66066 is a critical flaw (CVSS 9.5) allowing unauthenticated attackers to read server files and execute code through crafted image uploads. Key details include:
- **CVE ID:** CVE-2026-66066
- **Impacted Versions:** Active Storage versions less than 7.2.3.2, between 8.0.0.beta1 and 8.0.5.0, and 8.1.0.beta1 to 8.1.3.0.
- **Exploit Path:** Attackers exploit unsafe operations in the libvips image processor, gaining access to sensitive information like secret_key_base.
- **Public Exploit:** A Metasploit module automates this exploit, stressing the urgency of a patch.
- **Patch Available:** Users should upgrade to versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 and ensure they use libvips version 8.13 or newer. The CVE remains unexploited, but the risk of exposure highlights the need for immediate action.