CVE-2026-66066

CVE Enrichment

CVSS: 9.5 CRITICAL
EPSS: 26.52%
EPSS Percentile: 98.00%
CISA KEV: Not listed

Description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 31-Jul-2026 02:18
Last Modified: 11-Sep-2026 03:36
EPSS Date: 2026-10-25
CWE: CWE-1188

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 03-Nov-2026 15:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

A critical flaw in Rails Active Storage, tracked as CVE-2026-66066, can let an unauthenticated attacker read arbitrary files and potentially achieve remote code execution when libvips is used. Rails Patches Critical Active Storage Flaw That Can Expose Files and Enable RCE
Tracked as CVE-2026-66066 (CVSS score of 9.5), the critical security defect is described as an arbitrary file read that potentially exposes secrets, allowing remote attackers to execute code or move laterally to other Ruby on Rails Patches Critical Active Storage Vulnerability
Ruby on Rails has fixed CVE-2026-66066, a critical Active Storage flaw that could let unauthenticated attackers read arbitrary files through crafted image uploads when libvips is used. Critical Rails Active Storage Flaw Enables Unauthenticated File Reads

People (4)

MITRE ATT&CK (2)

Vendors (1)

Products (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.