Skip to main content

Rails Active Storage EUVDEUVD-2026-51270

| CVE-2026-66066 CRITICAL
Initialization of a Resource with an Insecure Default (CWE-1188)
2026-07-29 GHSA-xr9x-r78c-5hrm
RCE
9.5
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
9.5 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Network-reachable unauthenticated upload endpoint; S:C because file read extends beyond Active Storage's trust boundary to arbitrary server paths and enables full RCE via Rails signing secrets.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Jul 30, 2026 - 20:03 EUVD
CVSS changed
Jul 30, 2026 - 19:22 NVD
9.5 (CRITICAL)
Analysis Generated
Jul 30, 2026 - 00:17 vuln.today
CVE Published
Jul 29, 2026 - 22:48 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical RCE in Ruby on Rails Active Storage libvips Processor - CVE-2026-66066 Jul 30, 2026

AnalysisAI

Arbitrary file read and remote code execution in Ruby on Rails Active Storage's libvips-based variant processor allows unauthenticated remote attackers to upload a crafted file and invoke unsafe libvips 'unfuzzed' operations, disclosing arbitrary server files including process environment variables that typically contain secret_key_base and external service credentials. Applications using the libvips variant processor (the default since load_defaults 7.0) that accept image uploads from untrusted users across activestorage versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1 are affected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Upload crafted non-image file via standard upload endpoint
Delivery
Request variant generation to trigger libvips processing
Exploit
libvips invokes unfuzzed loader on attacker-controlled file
Install
Unfuzzed operation reads arbitrary server path (e.g., /proc/self/environ)
C2
Attacker retrieves exfiltrated file contents including secret_key_base
Execute
Forge signed Rails session cookie or serialized payload
Impact
Achieve remote code execution as application process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two conditions must hold simultaneously. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.0 score of 9.5 (Critical) with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H accurately reflects the severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting a Rails 8.x SaaS platform that permits user profile image uploads crafts a file exploiting a non-web-image unfuzzed libvips loader. After uploading the file through the normal image upload endpoint, the attacker requests a URL that triggers variant generation; libvips invokes the unfuzzed operation on the crafted file and returns the contents of /proc/self/environ as image data. …
Remediation The primary fix is upgrading the rails gem to 7.2.3.2, 8.0.5.1, or 8.1.3.1 as appropriate, and simultaneously upgrading libvips to version 8.13 or later - Rails patching alone is insufficient if the system libvips remains below 8.13. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all Rails applications running Active Storage on versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1; immediately disable or restrict image upload functionality or move it behind authentication to untrusted users. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8
CVE-2025-70998 CRITICAL POC
9.8
CVE-2021-42109 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0

Share

EUVD-2026-51270 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy