Herodevs Critical RCE Vulnerability in Rails Active Storage Disclosed
Article Content
- •CVE-2026-66066 is a critical RCE vulnerability affecting Rails Active Storage.
- •The flaw allows unauthenticated attackers to read arbitrary files on the server.
- •Patches are available in specific Rails versions; users must upgrade to secure their applications.
On July 29, 2026, the Ruby on Rails security team published CVE-2026-66066, a critical arbitrary file read and remote code execution (RCE) vulnerability in Active Storage. Discovered by the Ethiack research team, this flaw affects default configurations of Rails 6.x, 7.x, and 8.x that utilize the vips image processor. Attackers can exploit this vulnerability to read arbitrary files on the server, including sensitive credentials, without authentication in certain setups. The vulnerability has been assigned a CVSS score of 9.5 and affects an estimated 500,000+ sites. Fixes were released in Rails versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Users are advised to upgrade immediately to mitigate the risk. The vulnerability is particularly concerning due to the widespread use of Active Storage in production applications.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (16)
Following this threat?
Track Debian and CVE-2026-64645 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…