CVE-2026-66066: Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Critical severity · published Jul 30, 2026

CVE-2026-66066

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

9.5

CVSS

26.5%

EPSS

On KEV

Description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Exploitation

Is it being used?

Exploit prediction (EPSS)26.5% · higher than 98% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

rails · rails

< 7.2.3.2; >= 8.0.0.beta1, < 8.0.5.1; >= 8.1.0.beta1, < 8.1.3.1 · source: vendor

In the news

VulnerabilityCritical

Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity

Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. CVE-2026-66066 aka

CVE-2026-0768 CVE-2026-66066

Sep 1, 2026·The Hacker News

VulnerabilityCritical

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

A critical security vulnerability (CVE-2026-66066) in Ruby on Rails (aka Rails), one of the most widely used frameworks for building websites and web apps, may allow attackers to read sensitive files off a server and, in some cases, take full control of it. Nicknamed “KindaRails2Shell” by the researchers who found it, the flaw lets an attacker sneak a booby-trapped file past a website’s image-upload feature and use it to pry open the server’s secrets. About … More → The post KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066) appeared first on Help Net Security .

CVE-2026-66066

Aug 3, 2026·Help Net Security

VulnerabilityCritical

Ruby on Rails Patches Critical Active Storage Vulnerability Affecting Image Processing

Ruby on Rails fixed a critical vulnerability that could let unauthenticated attackers read files and achieve remote code execution. Ruby on Rails has patched CVE-2026-66066, a critical vulnerability (CVSS score of 9.5) that could allow unauthenticated attackers to read arbitrary files from vulnerable servers. In the default configuration, applications that generate image variants may expose […]

CVE-2026-66066

Aug 3, 2026·Security Affairs

VulnerabilityCritical

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

CVE-2026-66066

Jul 29, 2026·The Hacker News

Affected product

rails

All rails CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-66066

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-66066

github.com

https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e