CVE

CVE-2026-66066

View on NVD ↗

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

MITRE ATT&CK TTPs 4

T1059
Command and Scripting Interpreter
Execution
 T1078
Valid Accounts
Defense Evasion
 T1190
Exploit Public-Facing Application
Initial Access
 T1484
Domain or Tenant Policy Modification
Defense Evasion

Source Articles

Rails patches critical Active Storage flaw with RCE potential
A critical vulnerability, CVE-2026-66066, in the Rails Active Storage component allows unauthenticated attackers to read arbitrary files from a Rails application by uploading a specially crafted image when libvips is used for image processing. If successful, attackers can extract sensitive environment variables such as 'secret_key_base', enabling session forgery, data manipulation, and remote code execution (RCE). The vulnerability affects Active Storage versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1, with no workaround available for older libvips versions. Public proof-of-concept exploits have accelerated disclosure and prompted WAF protections from Akamai.
bleeping-computer Aug 1, 2026