Trending
CVE-2026-66066

CVE detail

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

CVSS 9.5 · CriticalBuzz score 48.3

Buzz score

Why this CVE is surfacing

Buzz score total 48.3

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 28.3 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0

Mention score

28.3

16 evidence mentions in the snapshot

Diversity score

20.0

6 sources across 4 categories

KEV score

0.0

No KEV entry observed

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 16; within the 30d window
Peak daily: 11; highest bucket

Evidence

Source links by recency

Newest mentions first

16 source links · newest first

Rails: Arbitrary file read and remote code execution in Active StorageHacker News
Linked URL: https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432 | Posted by lobo_tuerto | 3 points | 0 comments
communitynews.ycombinator.comJul 31, 2026, 2:53 PM
KindaRails2Shell attack details and tools to perform a forensic investigationHacker News
Linked URL: https://github.com/rails/rails-forensics-CVE-2026-66066 | Posted by ezekg | 3 points | 0 comments
communitynews.ycombinator.comJul 31, 2026, 2:16 PM
https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066ethiack.com
No excerpt available.
Exploitethiack.comJul 30, 2026, 7:18 PM
http://www.openwall.com/lists/oss-security/2026/07/29/9www.openwall.com
No excerpt available.
Exploitwww.openwall.comJul 30, 2026, 7:18 PM
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.ymlgithub.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrmgithub.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
https://github.com/rails/rails/releases/tag/v8.1.3.1github.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
https://github.com/rails/rails/releases/tag/v8.0.5.1github.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
https://github.com/rails/rails/releases/tag/v7.2.3.2github.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49agithub.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5github.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1egithub.com
No excerpt available.
Exploitgithub.comJul 30, 2026, 7:18 PM
KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on RailsRapid7
Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066 , a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classified as Initialization of
vendorwww.rapid7.comJul 30, 2026, 4:11 PM
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image UploadsThe Hacker News
d let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,
newsthehackernews.comJul 29, 2026, 6:10 PM
Arbitrary file read and remote code execution in Active StorageHacker News
Linked URL: https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432 | Posted by baggy_trough | 5 points | 0 comments
communitynews.ycombinator.comJul 29, 2026, 3:58 PM
KindaRails2Shell – Critical RCE in Rails via Active StorageHacker News
Linked URL: https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066 | Posted by tenderlove | 6 points | 0 comments
communitynews.ycombinator.comJul 29, 2026, 3:42 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-67208
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 d…
CVSS 9.3 · Critical
2 mentions
CVE-2026-65881
Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read…
CVSS 7.5 · High
1 mention
CVE-2026-9680
Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on a…
CVSS 5.8 · Medium
1 mention
CVE-2026-47668
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the…
CVSS 10.0 · Critical
3 mentions
CVE-2026-55708
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already co…
CVSS 3.1 · Low
2 mentions
CVE-2026-47393
PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) tha…
CVSS 9.8 · Critical
4 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2026-66066.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

Product query unavailableNo valid raw CPE 2.3 product record is available for this CVE, so no product-level Shodan query is shown.

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2026-66066Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Received

Published

Jul 30, 2026

Modified

Jul 31, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs

Vendor classifications

Unavailable

How this vector reads

CVSS 4.0 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Attack Requirements (AT): Present. A prerequisite deployment or execution condition must be present.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): None. Exploitation does not require a targeted user to act.
Vulnerable System Confidentiality (VC): High. There is a total or serious impact to this security property.
Vulnerable System Integrity (VI): High. There is a total or serious impact to this security property.
Vulnerable System Availability (VA): High. There is a total or serious impact to this security property.
Subsequent System Confidentiality (SC): High. There is a total or serious impact to this security property.
Subsequent System Integrity (SI): High. There is a total or serious impact to this security property.
Subsequent System Availability (SA): High. There is a total or serious impact to this security property.

Optional CVSS v4 metrics remain in the raw vector; only base metrics are expanded here.

Signals

Exploitation indicators

0 stored signals · no KEV · 0 OTX pulses