Active Storage Vulnerability in Rails Affects Image Upload Security
CVE-2026-66066

9.5CRITICAL

Key Information:

Vendor: Rails
Status: Rails
Vendor: CVE Published:; 30 July 2026

Badges

🔥 Trending now📈 Trended📈 Score: 3,070👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-66066?

CVE-2026-66066 is a significant vulnerability impacting the Active Storage component of the Rails framework, which is widely used for developing web applications. Active Storage simplifies the management of file uploads, particularly images, allowing developers to integrate file handling seamlessly into their applications. In versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1, this vulnerability allows unsafe operations to be performed on image uploads from untrusted sources, as the framework fails to disable certain libvips operations deemed unsafe. If an attacker uploads a maliciously crafted image, they can potentially exploit this vulnerability to read files within the server's context, including sensitive information such as environment variables and application secrets. This could lead to dire consequences for organizations, as exposure of critical credentials may enable unauthorized access to backend systems, data leaks, and even remote code execution.

Potential impact of CVE-2026-66066

Data Exposure: The vulnerability permits attackers to access sensitive files, such as application configuration and environment variables, which may contain crucial credentials and tokens. This can lead to unauthorized data access or exfiltration.
Remote Code Execution: With the potential to acquire sensitive information, attackers could leverage exposed credentials to execute arbitrary code on the server. This escalation of privileges can result in full system compromise and further attacks within the network.
Reputational Damage: Exploitation of this vulnerability can lead to severe reputational harm for affected organizations. Data breaches or service interruptions caused by unauthorized access not only compromise customer trust but may also result in regulatory repercussions and financial losses.

Affected Version(s)

rails < 7.2.3.2 < 7.2.3.2

rails >= 8.0.0.beta1, < 8.0.5.1 < 8.0.0.beta1, 8.0.5.1

rails >= 8.1.0.beta1, < 8.1.3.1 < 8.1.0.beta1, 8.1.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-66066-POC
Created by Zer0SumGam3