Active Storage

Reported Context (3)

A critical flaw in Rails Active Storage, tracked as CVE-2026-66066, can let an unauthenticated attacker read arbitrary files and potentially achieve remote code execution when libvips is used. Rails Patches Critical Active Storage Flaw That Can Expose Files and Enable RCE
The issue impacts applications that use the libvips library for Active Storage image processing and that allow image uploads from untrusted users. Ruby on Rails Patches Critical Active Storage Vulnerability
Ruby on Rails has fixed CVE-2026-66066, a critical Active Storage flaw that could let unauthenticated attackers read arbitrary files through crafted image uploads when libvips is used. Critical Rails Active Storage Flaw Enables Unauthenticated File Reads

CVE (1)

People (4)

MITRE ATT&CK (2)

Vendors (1)

Products (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.