Skip to content
1.
A technical deep-dive into CVE-2026-66066, where a malformed MATLAB file slips past libvips handling in Rails ActiveStorage to achieve arbitrary file read and unauthenticated RCE on default setups.
← back | CVE Intelligence
CVE-2026-66066 [Critical]
Curated 3 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-66066.
- Vendor
- Ruby on Rails
- Product
- Active Storage
- Affected versions
- Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13
- CVSS
- 9.5
- Coverage Span
- 2026-07-29 → 2026-07-31
- Reports
- 3 related reports
Associated Reports & Timeline
2.
A reproducible lab and Python PoC for CVE-2026-66066: a crafted image reads SECRET_KEY_BASE from the Rails process environment to sign a payload that triggers blind RCE on stock Rails 8.1.3.
Why it matters: The public PoC turns the disclosure into a reproducible exploit chain, lowering the barrier to reproduction. Defenders should upgrade Rails and libvips promptly and run this tool only in isolated, authorized local environments.
3.
ethiack.com | vulnerability | Critical | | original ↗ | #rce | #ruby-on-rails | #active-storage | #libvips
Ethiack research team discovered KindaRails2Shell (CVE-2026-66066): a critical RCE in Ruby on Rails via Active Storage. 500,000+ sites affected. Find out if you are and how to mitigate.
Why it matters: A default Rails image-processing path can expose process secrets and lead to remote code execution. Defenders must upgrade both Active Storage and libvips, then rotate any secrets that may already have been readable.