CVE-2026-66066 PoC: Rails Active Storage file-read-to-RCE chain

CVE

CVE-2026-66066

Vendor

Ruby on Rails

Product

Active Storage

Affected versions

Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13

CVSS

9.5

Published

2026-07-29 21:08

Collected

2026-07-30 09:28

---
id: 5571
title: "CVE-2026-66066 PoC: Rails Active Storage file-read-to-RCE chain"
cve: CVE-2026-66066
cvss: 9.5
severity: critical
vendor: "Ruby on Rails"
product: "Active Storage"
affected_versions: "Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13"
source_domain: github.com
source_url: "https://github.com/Zer0SumGam3/CVE-2026-66066-POC"
published_at: "2026-07-29T21:08:30Z"
tags: ["rce", "public-poc", "ruby-on-rails", "active-storage", "libvips", "arbitrary-file-read", "exploit", "poc", "rails", "cve-2026-66066"]
phying_url: "https://phying.com/item/5571"
lang: en
---

# CVE-2026-66066 PoC: Rails Active Storage file-read-to-RCE chain

## Summary

A reproducible lab and Python PoC for CVE-2026-66066: a crafted image reads SECRET_KEY_BASE from the Rails process environment to sign a payload that triggers blind RCE on stock Rails 8.1.3.

## Why it matters

The public PoC turns the disclosure into a reproducible exploit chain, lowering the barrier to reproduction. Defenders should upgrade Rails and libvips promptly and run this tool only in isolated, authorized local environments.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-66066
- **CVSS:** 9.5
- **Vendor:** Ruby on Rails
- **Product:** Active Storage
- **Affected versions:** Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13
- **Published:** 2026-07-29T21:08:30Z
- **Original:** https://github.com/Zer0SumGam3/CVE-2026-66066-POC
- **Phying News:** https://phying.com/item/5571