Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability, CVE-2026-66066 (CVSS 9.5), that could allow unauthenticated attackers to read…
Tag: CVE-2026-66066
CVE-2026-66066: Critical Active Storage Vulnerability in Ruby on Rails
CVE-2026-66066 is a critical vulnerability in Ruby on Rails Active Storage with a CVSS score of 9.5. It allows unauthenticated attackers to…
Ethiack: Cybersecurity Research Firm
Ethiack is a cybersecurity research firm credited with independently reporting CVE-2026-66066 to the Ruby on Rails team. Researchers André Baptista, Bruno Mendes,…
GMO Flatt Security: Cybersecurity Company
GMO Flatt Security is a cybersecurity company that independently reported CVE-2026-66066. Researcher RyotaK was credited for the discovery.
Ruby on Rails: Web Application Framework
Ruby on Rails is an open-source web application framework. A critical vulnerability in its Active Storage component, CVE-2026-66066, allows unauthenticated file reads…
Active Storage: File Upload Service for Rails
Active Storage is a Ruby on Rails component for handling file uploads. It is affected by CVE-2026-66066, which allows unauthenticated attackers to…
libvips: Image Processing Library
libvips is an image processing library used by Active Storage. Versions prior to 8.13 are vulnerable to CVE-2026-66066, which allows unsafe operations…
ruby-vips: Ruby Binding for libvips
ruby-vips is the Ruby binding for the libvips image processing library. Version 2.2.1 or later is required to mitigate CVE-2026-66066 by calling…