Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Rails Active Storage arbitrary file read and RCE flaw (CVE-2026-66066)

Vulnerability
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-66066 leaves Rails Active Storage vulnerable to arbitrary file read and possible RCE when libvips handles untrusted image uploads. The flaw affects Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1, with public PoC exploits accelerating disclosure and response.

Related Happenings

Rails Active Storage mitigation guidance for CVE-2026-66066

Advisory/Mitigation
H score40 First: 01.08.2026 17:20 Last: 01.08.2026 17:20 Sources 1

How related: The Rails team recommends upgrading to libvips 8.13 or later and rotating the ‘secret_key_base’ (the Rails master key), database credentials, Active Storage service credentials, and any other secrets accessible to the application process.

About this happening: Rails maintainers issued mitigation guidance for CVE-2026-66066, directing Active Storage operators to upgrade to libvips 8.13 or later and rotate secrets after th...

Open Happening

Timeline

  1. 01.08.2026 17:20 2 articles · 2h ago

    Rails publishes advisory for critical Active Storage arbitrary file read flaw

    Initial Disclosure

    Rails maintainers published a critical advisory for CVE-2026-66066 in Active Storage, warning that an unauthenticated attacker can read arbitrary files from a Rails application and potentially reach remote code execution when libvips processes specially crafted image uploads from untrusted users. The flaw affects Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1, while Rails 6.x is only affected when Active Storage is configured outside its defaults. The recommended response is to upgrade to libvips 8.13 or later, rotate secret_key_base plus database, Active Storage service, and other exposed credentials, and use VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true) where supported; no workaround exists for libvips before 8.13. The vulnerability was reported by Ethiack and GMO Flatt Security Inc., and Akamai later warned about the KindaRails2Shell attack chain and released WAF protections.

    Show sources
    Open in new tab