CVE-2026-66066

Katalog CVE

CVSS 9.5 · Critical EPSS 27,9%

Kerentanan Initialization of a Resource with an Insecure Default. Skor CVSS 4.0 9.5 (Critical) menurut github.com.

Deskripsi (NVD)

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

10 September 2026

Status NVD

Awaiting Analysis

CVSS 4.0

9.5 (Critical), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

27,9% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e
• https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5
• https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a
• https://github.com/rails/rails/releases/tag/v7.2.3.2
• https://github.com/rails/rails/releases/tag/v8.0.5.1
• https://github.com/rails/rails/releases/tag/v8.1.3.1
• https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml
• https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html
• http://www.openwall.com/lists/oss-security/2026/07/29/9
• http://www.openwall.com/lists/oss-security/2026/08/01/6
• https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066
• https://github.com/rails/rails-forensics-CVE-2026-66066