Skip to content
OpenAdvisories
Critical · 9.5 Public exploit CVE-2026-66066 EUVD-2026-51270GHSA-xr9x-r78c-5hrm

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Published Jul 30, 2026 · Updated Aug 5, 2026 · Assigned by GitHub_M

Vendor: rails Product: rails Package: activestorage Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Affected products

VendorProductAffectedFixed
rails rails < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:7.2.3.2+dfsg-1 —
Debian 13 rails 2:7.2.2.2+dfsg-2~deb13u2 —
Debian 12 rails 2:6.1.7.10+dfsg-1~deb12u3 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rails No fix yet —
Ubuntu 26.04 LTS rails No fix yet —
Ubuntu 24.04 LTS rails No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS rails No fix yet —
Ubuntu Pro 20.04 LTS rails No fix yet —
Ubuntu Pro 18.04 LTS rails No fix yet —
Ubuntu Pro 16.04 LTS rails No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 hawk2 2.7.2+git.1788518533.7d4dadd6-160000.1.1 SUSE-SU-2026:24250-1
SLES 16.0 hawk2 2.7.2+git.1788518533.7d4dadd6-160000.1.1 SUSE-SU-2026:24195-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed hawk2 2.7.2+git.1792148770.648dcddb-1.1 openSUSE-SU-2026:12153-1
openSUSE Leap 16.0 hawk2 2.7.2+git.1788518533.7d4dadd6-160000.1.1 openSUSE-SU-2026:22068-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 7 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems activestorage < 7.2.3.2 7.2.3.2 GHSA-xr9x-r78c-5hrm
RubyGems activestorage >= 8.0.0.beta1, < 8.0.5.1 8.0.5.1 GHSA-xr9x-r78c-5hrm
RubyGems activestorage >= 8.1.0.beta1, < 8.1.3.1 8.1.3.1 GHSA-xr9x-r78c-5hrm

Advisories 6

References