CVE-2026-66066: Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 27.9%, percentile 98: FIRST’s model estimates a 27.9% chance of exploitation activity in the next 30 days, higher than 98% of all scored CVEs (very high). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes activestorage (RubyGems) < 7.2.3.2, fixed in 7.2.3.2; activestorage (RubyGems) >= 8.0.0.beta1, < 8.0.5.1, fixed in 8.0.5.1; activestorage (RubyGems) >= 8.1.0.beta1, < 8.1.3.1, fixed in 8.1.3.1. Check your lockfile, including transitive dependencies.

What it is

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secretkeybase or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

From the GitHub advisory

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.

Details libvips reads and writes file formats through "loaders" and "savers" (or more generally "operations"), many of which are backed by third-party libraries. It marks some of these operations as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats unrelated to web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload a crafted file and cause a variant to be generated from it may be able to invoke one.

We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application. One specific attack chain has been reported to us (see "Disclosure" below), but we do not assume it is the only one that exists.

Affected applications An application is affected if it meets all of these requirements: - Uses libvips for Active Storage image processing. This is config.activestorage.variantprocessor = :vips, which loaddefaults 7.0 set and no later default has changed. - Allows image uploads from untrusted users.

Generating variants is not a separate requirement.

Weakness type: CWE-1188.

Product: activestorage (RubyGems) · Assigned by: GitHub_M · Published: 2026-07-30

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: present (depends on deployment conditions)
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 27.86% probability of exploitation activity in the next 30 days; percentile 98.

Timeline

• 2026-07-30 — CVE record published by GitHub_M
• 2026-07-30 — GitHub-reviewed advisory GHSA-xr9x-r78c-5hrm published (critical)
• 2026-08-05 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-xr9x-r78c-5hrm github.com
2. CVE.org record CVE-2026-66066 cve.org
3. NVD entry CVE-2026-66066 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. github.com github.com
6. github.com github.com
7. github.com github.com
8. github.com github.com
9. thehackernews.com thehackernews.com
10. openwall.com openwall.com
11. ethiack.com ethiack.com
12. openwall.com openwall.com
13. github.com github.com
14. cve.org cve.org

Critical RubyGems advisories · Today’s Security Digest