Skip to content
CVE-2026-66066 PoC: Rails Active Storage file-read-to-RCE chain
github.com | tool | CVE-2026-66066 | #rce | #public-poc | #ruby-on-rails | #active-storage | #libvips | #arbitrary-file-read | #exploit | #poc | #rails | #cve-2026-66066
Summary
A reproducible lab and Python PoC for CVE-2026-66066: a crafted image reads SECRET_KEY_BASE from the Rails process environment to sign a payload that triggers blind RCE on stock Rails 8.1.3.
Why it matters
The public PoC turns the disclosure into a reproducible exploit chain, lowering the barrier to reproduction. Defenders should upgrade Rails and libvips promptly and run this tool only in isolated, authorized local environments.
- Vendor
- Ruby on Rails
- Product
- Active Storage
- Affected versions
- Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13
- CVSS
- 9.5
- Published
- Collected