CVE-2026-66066

Received Received - Intake

Active Storage libvips Unsafe Operation Arbitrary File Read

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-66066

EUVD

EUVD-2026-51270

Affected Vendors & Products

Vendor	Product	Version / Range
rubyonrails	action_pack	to 7.2.3.2 (exc)
rubyonrails	action_pack	to 8.0.5.1 (exc)
rubyonrails	action_pack	to 8.1.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

This vulnerability affects Action Pack, a web request framework, in versions before 7.2.3.2, 8.0.5.1, and 8.1.3.1. Active Storage fails to disable unsafe libvips operations for untrusted uploads, allowing crafted images to trigger these operations. An attacker can exploit this to read arbitrary files accessible to the Rails process, including secrets like environment variables.

Detection Guidance

To detect this vulnerability, check the version of Action Pack and Active Storage in your Ruby on Rails application. Run commands like 'gem list | grep actionpack' and 'gem list | grep activestorage' to verify if you are using a vulnerable version (prior to 7.2.3.2, 8.0.5.1, or 8.1.3.1). Additionally, inspect your application's configuration to confirm if libvips is enabled for image processing.

Impact Analysis

If you use a vulnerable version of Action Pack with libvips and allow untrusted image uploads, an attacker could read sensitive files on your server. This includes credentials like secret_key_base or tokens, which may lead to remote code execution or further network compromise.

Compliance Impact

This vulnerability may lead to exposure of sensitive data such as environment variables and application secrets, which could include credentials or tokens. Such breaches could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, depending on the data processed.

Mitigation Strategies

Immediately upgrade Action Pack to version 7.2.3.2, 8.0.5.1, or 8.1.3.1 or later. If you cannot upgrade immediately, disable libvips for Active Storage by setting 'config.active_storage.variant_processor = :mini_magick' in your Rails configuration. Also, review file upload permissions and restrict access to sensitive files.

Hi! I’m here to help you understand CVE-2026-66066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70