THREAT OPS › Threat News › [NVD] CVE-2026-66066 — Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming appl
[NVD] CVE-2026-66066 — Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming appl
CVE-2026-66066 CVSS: None Published: 2026-07-30T19:18:35.843
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-66066cve
- 7.2.3.2ipv4
- 8.0.5.1ipv4
- 8.1.3.1ipv4
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-66066
Same event, other sources
- Rails CVE-2026-66066: Possible arbitrary file read and remote code execution in Active Storage variant processingoss_sec · 2026-07-29
- CVE-2026-66066: Defending Against the “KindaRails2Shell” Pre-Auth RCEakamai_blog · 2026-07-30
- KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Railsrapid7 · 2026-07-30
- Re: Rails CVE-2026-66066: Possible arbitrary file read and remote code execution in Active Storage variant processingoss_sec · 2026-08-01
- Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)rapid7 · 2026-08-03