Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Ruby on Rails Patches Critical Vulnerability

Part of the CVE-2026-66066 story · since 30 Jul

Quiet for 9 weekslast report 31 Aug7 articles4 outlets
30 Jul · SecurityOnline first16 Sep2 OctNowThis article4th of 7
  • Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
  • Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
  • Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
  • Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability. This article, 4th of 7.
  • Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
  • Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
  • Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.

Ruby on Rails has released patches for a critical vulnerability (CVE-2026-66066) that could enable unauthenticated attackers to achieve remote code execution through arbitrary file reads. The flaw primarily affects applications using the libvips library for image processing and those allowing uploads from untrusted users. It has a high CVSS score of 9.5, indicating severe risk.

Attackers could leverage this vulnerability to access sensitive information such as secret keys and credentials stored in the application's environment. Users are urged to update their Rails deployments and the libvips library to mitigate this vulnerability. As of now, there is no evidence of exploitation in the wild.

How the story developed

All 7 articles
Quiet for 9 weekslast report 31 Aug7 articles4 outlets

7 articles from 4 outlets since 30 Jul. Quiet since 31 Aug. This was the 4th report, 2 days after the first.

Now30 Jul1 Aug3431First reportSecurityOnline · 30 Jul, 04:31This article4th of 7 · day 2Picked up againafter 4 weeks quiet
  • Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
  • Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
  • Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
  • Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability. This article, 4th of 7.
  • Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
  • Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
  • Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Thu 30 JulDay 02
    1. Critical Rails flaw exposes files, risks RCE via CVE-2026-6606604:31 · SecurityOnline · First report
    2. Critical Ruby on Rails Bug Exposes Files via Image Upload16:59 · Rapid7

  2. Quiet for 2 days

    Sat 1 AugDay 22
    1. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public11:25 · SecurityOnline
    2. Ruby on Rails Patches Critical Vulnerability11:25 · SecurityWeek · This article, 4th of 7

  3. Quiet for 2 days

    Mon 3 AugDay 42
    1. Ruby on Rails fixes critical Active Storage bug CVE-2026-6606607:26 · Security Affairs
    2. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails19:21 · Rapid7

  4. Quiet for 4 weeks

    Mon 31 AugDay 321
    1. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution11:29 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in