SecurityOnlineDo Son
CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public
Part of the CVE-2026-66066 story · since 30 Jul
Quiet for 9 weekslast report 31 Aug7 articles4 outlets
- Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
- Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
- Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public. This article, 3rd of 7.
- Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
- Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
- Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
- Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.
The Rails Active Storage vulnerability CVE-2026-66066 is a critical flaw (CVSS 9.5) allowing unauthenticated attackers to read server files and execute code through crafted image uploads. Key details include:
- **CVE ID:** CVE-2026-66066
- **Impacted Versions:** Active Storage versions less than 7.2.3.2, between 8.0.0.beta1 and 8.0.5.0, and 8.1.0.beta1 to 8.1.3.0.
- **Exploit Path:** Attackers exploit unsafe operations in the libvips image processor, gaining access to sensitive information like secret_key_base.
- **Public Exploit:** A Metasploit module automates this exploit, stressing the urgency of a patch.
- **Patch Available:** Users should upgrade to versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 and ensure they use libvips version 8.13 or newer. The CVE remains unexploited, but the risk of exposure highlights the need for immediate action.
How the story developed
Quiet for 9 weekslast report 31 Aug7 articles4 outlets
7 articles from 4 outlets since 30 Jul. Quiet since 31 Aug. This was the 3rd report, 2 days after the first.
- Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
- Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
- Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public. This article, 3rd of 7.
- Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
- Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
- Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
- Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Thu 30 JulDay 02
- Critical Rails flaw exposes files, risks RCE via CVE-2026-6606604:31 · SecurityOnline · First report
Quiet for 2 days
Sat 1 AugDay 22- CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public11:25 · SecurityOnline · This article, 3rd of 7
- Ruby on Rails Patches Critical Vulnerability11:25 · SecurityWeek
Quiet for 2 days
Mon 3 AugDay 42- Ruby on Rails fixes critical Active Storage bug CVE-2026-6606607:26 · Security Affairs
Quiet for 4 weeks
Mon 31 AugDay 321- CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution11:29 · SecurityWeek · Picked up again