Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
Higher than 98% of scored CVEs
DescriptionNVD
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.
Coverage7 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 30 Jul.
- Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
- Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
- Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
- Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
- Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
- Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
- Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 30 Jul 04:31 | SecurityOnline | Critical Rails flaw exposes files, risks RCE via CVE-2026-66066 |
| 30 Jul 16:59 | Rapid7 | Critical Ruby on Rails Bug Exposes Files via Image Upload |
| 1 Aug 11:25 | SecurityOnline | CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public |
| 1 Aug 11:25 | SecurityWeek | Ruby on Rails Patches Critical Vulnerability |
| 3 Aug 07:26 | Security Affairs | Ruby on Rails fixes critical Active Storage bug CVE-2026-66066 |
| 3 Aug 19:21 | Rapid7 | CVE-2026-66066 flaw lets attackers read files in Ruby on Rails |
| 31 Aug 11:29 | SecurityWeek | CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution |
- Ruby on Rails fixes critical Active Storage bug CVE-2026-66066Security Affairs
- Ruby on Rails Patches Critical VulnerabilitySecurityWeek
- Critical Rails flaw exposes files, risks RCE via CVE-2026-66066SecurityOnline · first in our coverage
New articles also arrive in the RSS feed.