Threadlinqs IntelligenceStart free

VulnerabilityCVE-2026-66066Published 2026-07-30

CVE-2026-66066 — rails

critical (derived)Public exploit8 PoC repos

As of 2026-08-05, CVE-2026-66066 is a Critical-severity (band derived from the CVSS v4.0 score, not stated by the CNA) vulnerability in rails, CVSS v4.0 9.5, EPSS 27.8% (98.0th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-66066, most recently “CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing”.

CVSS v4.0
9.5/10Critical (derived)
EPSS
27.8%Higher than 98.0% of scored CVEs
CISA KEV
NoNot in the KEV catalog
Tracked threats
1Campaigns referencing it
Priority
10/10Threadlinqs triage score
Published
Updated 2026-08-05
CVSS v4.0 9.5 (Critical, derived from score) · EPSS 27.8% (higher than 98.0% of all scored CVEs) · Priority 10/10 · Published 2026-07-30

Last updated:

What is CVE-2026-66066?

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

The record classifies CVE-2026-66066 under weakness class CWE-1188. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 84 days ago.

Severity and exploitation probability

CVSS v4.0 base score
9.5 — Critical (derived from score)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (FIRST)
27.8% probability of exploitation in the next 30 days, higher than 98.0% of all scored CVEs
CISA KEV
Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority
10/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published
2026-07-30, last modified 2026-08-05

Is CVE-2026-66066 being exploited?

Weaponised exploit code for CVE-2026-66066 is publicly available. 8 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 50 in the Threadlinqs vulnerability feed.

Affected products and versions

  • rails: rails

Affected software packages:

  • rubygems:activestorage — patched in 7.2.3.2
  • rubygems:activestorage — patched in 8.0.5.1
  • rubygems:activestorage — patched in 8.1.3.1

How to fix CVE-2026-66066

Fixed versions are recorded for 3 packages: rubygems:activestorage 7.2.3.2, rubygems:activestorage 8.0.5.1, rubygems:activestorage 8.1.3.1. No vendor patch reference has been recorded for CVE-2026-66066 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-66066

1 tracked threat in the Threadlinqs corpus references CVE-2026-66066, either in the campaign’s CVE list or as an indicator on the campaign record.

Sources

Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.

Vendor advisory and patch

Other references

Showing 6 of 9 recorded references.