Skip to main content

Rails Active Storage EUVDEUVD-2026-51270

| CVE-2026-66066 CRITICAL
Initialization of a Resource with an Insecure Default (CWE-1188)
2026-07-29 GHSA-xr9x-r78c-5hrm
RCE
9.5
CVSS 4.0 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Upload crafted non-image file via standard upload endpoint
  2. Delivery
    Request variant generation to trigger libvips processing
  3. Exploit
    libvips invokes unfuzzed loader on attacker-controlled file
  4. Install
    Unfuzzed operation reads arbitrary server path (e.g., /proc/self/environ)
  5. C2
    Attacker retrieves exfiltrated file contents including secret_key_base
  6. Execute
    Forge signed Rails session cookie or serialized payload
  7. Impact
    Achieve remote code execution as application process

Vulnerability Assessment

Weakness
CWE
CWE-1188
ASVS 5.0
V13 - Configuration Secure default settings
Exploitation Conditions

Two conditions must hold simultaneously. First, config.active_storage.variant_processor = :vips must be set - this is enabled automatically by load_defaults 7.0 and has not been changed as a default in any later Rails release, making it the common production configuration for Rails 7.x and 8.x applications. Second, the application must accept file uploads from untrusted users (unauthenticated or low-privilege) - there is no requirement that variants actually be generated from the uploaded file; the configuration being present is sufficient per the advisory. Per CVSS PR:N, no attacker authentication is required. Exploitation is excluded for applications explicitly configured with config.active_storage.variant_processor = :mini_magick, applications that do not permit untrusted file uploads, and applications running libvips >= 8.13 with VIPS_BLOCK_UNTRUSTED set or Vips.block_untrusted(true) called before this fix was released. Applications on Rails 6.x are affected per linked research but fall outside the scope of the official patched releases.
Impact

The vendor-assigned CVSS 4.0 score of 9.5 (Critical) with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H accurately reflects the severity. The AT:P modifier (attack prerequisites) appropriately captures that two conditions must coexist: libvips variant processing enabled and untrusted file uploads permitted. These are not niche conditions - load_defaults 7.0 sets the libvips processor as default, meaning the majority of Rails 7.x and 8.x applications in production are presumptively in scope unless they explicitly override to MiniMagick or prohibit untrusted uploads. No EPSS data is yet available for this newly disclosed CVE. The CVE is not in CISA KEV at time of analysis, so active exploitation is not authoritatively confirmed; however, technical details are withheld only until 2026-08-28, creating a narrow but real window before weaponization. The real-world risk is amplified because reading secret_key_base is a well-understood precondition for full RCE in Rails - attackers can forge session cookies or exploit other signing mechanisms - making the file-read-to-RCE escalation path concrete rather than theoretical.
Exploit ScenarioDerived

An attacker targeting a Rails 8.x SaaS platform that permits user profile image uploads crafts a file exploiting a non-web-image unfuzzed libvips loader. After uploading the file through the normal image upload endpoint, the attacker requests a URL that triggers variant generation; libvips invokes the unfuzzed operation on the crafted file and returns the contents of /proc/self/environ as image data. With secret_key_base extracted from the environment, the attacker forges a signed Rails session cookie or ActiveJob payload, achieving remote code execution. No confirmed public POC exists at time of analysis, but the exploit chain from file read to RCE via secret_key_base is well-documented in Rails security literature.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
1 public PoC + 2 unverified Patch available 1.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Arbitrary file read and remote code execution in Ruby on Rails Active Storage's libvips-based variant processor allows unauthenticated remote attackers to upload a crafted file and invoke unsafe libvips 'unfuzzed' operations, disclosing arbitrary server files including process environment variables that typically contain secret_key_base and external service credentials. Applications using the libvips variant processor (the default since load_defaults 7.0) that accept image uploads from untrusted users across activestorage versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1 are affected. No public exploit code has been released at disclosure time (July 30, 2026), but independent researchers from Ethiack and GMO Flatt Security assess that AI-assisted POC development is feasible within hours, making immediate patching critical.

RemediationAI

The primary fix is upgrading the rails gem to 7.2.3.2, 8.0.5.1, or 8.1.3.1 as appropriate, and simultaneously upgrading libvips to version 8.13 or later - Rails patching alone is insufficient if the system libvips remains below 8.13. Following any confirmed or suspected exposure, all secrets readable by the application process must be rotated: secret_key_base (which invalidates active user sessions and affects encrypted cookies, signed cookies, signed global IDs, and Active Storage signed URLs), the Rails master key (RAILS_MASTER_KEY or config/master.key) along with all config/credentials.yml.enc contents it decrypts, Active Storage backend credentials (S3, GCS, or Azure keys), database credentials, and all third-party API tokens. Do not retain an exposed secret as a rotation fallback. If an immediate upgrade is blocked and libvips >= 8.13 is already installed, set the environment variable VIPS_BLOCK_UNTRUSTED=1 as a temporary workaround - libvips reads this at startup to block unfuzzed operations. Applications with ruby-vips >= 2.2.1 can alternatively call Vips.block_untrusted(true) from an initializer. If libvips < 8.13 is in use, no in-place workaround exists: the only option is removing the ruby-vips dependency from the Gemfile (feasible for applications using ruby-vips only for image analysis rather than variant generation). WAF-based mitigations are assessed as having highly limited and configuration-specific effectiveness per linked research from Ethiack and GMO Flatt Security and should not be relied upon as a primary control.

Affected VersionsENISA

rails 8.0.0.beta1, < 8.0.5.1
rails < 7.2.3.2
rails 8.1.0.beta1, < 8.1.3.1

Affected Packages

rubygems activestorage fix: 7.2.3.2, 8.0.5.1, 8.1.3.1
euvd rails fix: 7.2.3.2
euvd rails_8_0_0_beta1 fix: 8.0.5.1
euvd rails_8_1_0_beta1 fix: 8.1.3.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in rubygems, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Active Storage, Rails' built-in file attachment framework, delegates image variant generation to libvips via the ruby-vips gem when configured with config.active_storage.variant_processor = :vips. libvips categorizes its format handlers as either fuzzed (hardened against malicious input) or 'unfuzzed' (unsafe for untrusted content, often backed by third-party libraries handling non-web formats). Since libvips 8.13, a blocking API exists - the VIPS_BLOCK_UNTRUSTED environment variable or Vips.block_untrusted(true) call - that prevents unfuzzed operations from executing. Active Storage did not invoke this mechanism, leaving all unfuzzed loaders and savers exposed to attacker-controlled files. CWE-1188 (Insecure Default Initialization of Resource) is the root cause: the safeguard existed in the dependency but was never activated. When a user uploads a crafted file and variant generation is triggered, libvips may invoke an unfuzzed operation that reads arbitrary filesystem paths - including /proc/self/environ - returning the contents as image data the attacker can retrieve.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 9.5 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
vuln.today AI 10.0 CRITICAL

Network-reachable unauthenticated upload endpoint; S:C because file read extends beyond Active Storage's trust boundary to arbitrary server paths and enables full RCE via Rails signing secrets.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE 8.9 HIGH
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Red Hat 8.9 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
High

Lifecycle Timeline

3
Patch available
Jul 30, 2026 - 20:03 EUVD
CVSS changed
Jul 30, 2026 - 19:22 NVD
9.5 (CRITICAL)
CVE Published
Jul 29, 2026 - 22:48 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 3

medium.com CVE-2026-66066: Rails Active Storage Arbitrary File Read Chains to RCE via libvips (KindaRails2Shell) Aug 20, 2026 News Critical RCE in Ruby on Rails Active Storage libvips Processor - CVE-2026-66066 Jul 30, 2026 POC CVE-2026-66066: Ruby on Rails Active Storage File-Read-to-RCE Chain via libvips HDF5 Parsing Jul 30, 2026

Latest POC

1 public PoC link from github, metasploit, plus 2 unverified

Sign in to open the public PoC links collected for this CVE.

Sign in to read

Executive ViewAI

Why It Matters

Ruby on Rails Active Storage applications are facing a critical vulnerability that allows unauthenticated attackers to steal sensitive credentials and database encryption keys from the server. The vulnerability affects all Rails versions below 7.2.3.2, 8.0.5.1, or 8.1.3.1 and could enable complete system compromise. With publicly available techniques, exploit code could be developed within hours, making immediate mitigation essential for any organization accepting user-uploaded images.

Business Impact: Severe
Compensating Controls

Disable the libvips variant processor or replace with alternative image processing library; restrict image uploads to authenticated users only; implement strict file type and size validation; deploy Web Application Firewall rules to block suspicious upload patterns; conduct daily monitoring of server file access logs for unusual activity. No vendor-released patch identified at time of analysis; priority watch Rails security advisories for patches targeting versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.

Threat Intelligence Overview

EPSS Score
1.7%
Top 25% exploitable
Prevalence
High
widely-deployed web framework, default config since Rails 7.0
Threat Intel
1
1 sources
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA POC (1) Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 1.7%
Patch available Yes
Active threat Yes
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

85
Low Medium High Critical
KEV: 0
EPSS: +2
CVSS: +48
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2018-8014 CRITICAL
9.8
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8
CVE-2025-70998 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected
SUSE Linux Enterprise High Availability Extension 16.1 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://blog.flatt.tech/entry/kindarails2shell_rails ADVISORY https://seclists.org/oss-sec/2026/q3/324 ADVISORY https://seclists.org/oss-sec/2026/q3/377 ADVISORY https://vuldb.com/vuln/384908 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-66066 ADVISORY https://www.libvips.org/2022/05/28/What's-new-in-8.13.html#blocking-of-unfuzzed-loaders REF http://www.openwall.com/lists/oss-security/2026/07/29/9 REF http://www.openwall.com/lists/oss-security/2026/08/01/6 REF https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066 REF https://github.com/rails/rails-forensics-CVE-2026-66066 REF https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e REF https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5 REF https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a REF https://github.com/rails/rails/releases/tag/v7.2.3.2 REF https://github.com/rails/rails/releases/tag/v8.0.5.1 REF https://github.com/rails/rails/releases/tag/v8.1.3.1 REF https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm REF https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml REF https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy