CVE-2026-66066

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Published Jul 30, 2026 CVSS 4.0 · 9.5 Critical EPSS 32.9% KEV · Not listed

Description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Analysis

Technical impact

Action Pack’s Active Storage component allows processing of image uploads via libvips, but it fails to disable libvips operations that are marked unsafe for untrusted content. A crafted image upload can trigger these operations, allowing an unauthenticated attacker to read any file accessible to the Rails process, including environment variables and application secrets. The exposure of such credentials could enable remote code execution or lateral movement within the application environment. This weakness corresponds to CWE‑1188 (Improper Restriction of Operations to Those Intended) and CWE‑434 (Unrestricted Upload of File with Dangerous Type).

Affected Systems

Rails applications built on the Action Pack framework that use libvips to process image uploads are vulnerable. Any version prior to 7.2.3.2, 8.0.5.1, or 8.1.3.1 is affected; upgrading to these releases or later mitigates the flaw.

Risk and Exploitability

The CVSS score of 9.5 marks this issue as critical. An EPSS score of 33% indicates that exploitation is considered likely. Although the vulnerability is not listed in the CISA KEV catalog, the attack vector is an unauthenticated image upload that triggers an unsafe libvips operation, resulting in unauthorized file read and potential credential compromise that could lead to remote code execution or lateral movement within the application environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rails

affected

Version	Status	Constraints
`< 7.2.3.2`	affected	—
`>= 8.0.0.beta1, < 8.0.5.1`	affected	—
`>= 8.1.0.beta1, < 8.1.3.1`	affected	—

No data.

Vendor Product Versions

Rails

Version	Status	Scheme	Platform
`[0,7.2.3.2)`	affected	generic	—
`[8.0.0.beta1,8.0.5.1)`	affected	generic	—
`[8.1.0.beta1,8.1.3.1)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Rails to 7.2.3.2, 8.0.5.1 or 8.1.3.1 or newer.
If an upgrade is not possible, reconfigure Active Storage to disable libvips processing for untrusted uploads or use a safer alternative image processor.
Enforce strict validation of all uploaded images, accept only trusted content, and rotate any credentials that may have been exposed.

Generated by OpenCVE AI on November 7, 2026 at 14:26 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4829-1	rails security update
Debian DSA	DSA-6546-1	rails security update
Github GHSA	GHSA-xr9x-r78c-5hrm	Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 32.9% (32.901% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/07/29/9
http://www.openwall.com/lists/oss-security/2026/08/01/6
https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066
https://github.com/rails/rails-forensics-CVE-2026-66066
https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e
https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5
https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a
https://github.com/rails/rails/releases/tag/v7.2.3.2
https://github.com/rails/rails/releases/tag/v8.0.5.1
https://github.com/rails/rails/releases/tag/v8.1.3.1
https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml
https://nvd.nist.gov/vuln/detail/CVE-2026-66066
https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html
https://www.cve.org/CVERecord?id=CVE-2026-66066

History

Aug 5, 2026 2:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://github.com/rails/rails-forensics-CVE-2026-66066
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 1, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-434
References		http://www.openwall.com/lists/oss-security/2026/07/29/9 https://nvd.nist.gov/vuln/detail/CVE-2026-66066 https://www.cve.org/CVERecord?id=CVE-2026-66066
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L'}` threat_severity `Important`

Jul 30, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rails Rails rails
Vendors & Products		Rails Rails rails

Jul 30, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 30, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.
Title		Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
Weaknesses		CWE-1188
References		https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5 https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a https://github.com/rails/rails/releases/tag/v7.2.3.2 https://github.com/rails/rails/releases/tag/v8.0.5.1 https://github.com/rails/rails/releases/tag/v8.1.3.1 https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html
Metrics		cvssV4_0 `{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`