https://vulnerability.circl.lu/sightings/feed 2026-07-30T21:19:41.101383+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/35300830-423a-4d7f-9352-f8f990c2d49e/export 2026-07-30T21:19:41.121795+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "35300830-423a-4d7f-9352-f8f990c2d49e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mrvci5bs5d2k", "content": "Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERTCC (Jul 30)\n\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-07-30T20:42:29.118692Z"} 2026-07-30T20:42:29.118692+00:00 https://vulnerability.circl.lu/sighting/7f760e89-1a51-4c03-89f2-2efab0aaedc1/export 2026-07-30T21:19:41.123700+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7f760e89-1a51-4c03-89f2-2efab0aaedc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/apzkbvj2mnhdq", "content": "CVE-2026-66066 - Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing\nCVE ID : CVE-2026-66066\n \n Published : July 30, 2026, 7:18 p.m. | 26\u00a0minutes ago\n \n Description : Action Pack is a framework for handling and responding to...", "creation_timestamp": "2026-07-30T20:06:13.466255Z"} 2026-07-30T20:06:13.466255+00:00 https://vulnerability.circl.lu/sighting/74056ade-c25d-4492-8997-94a4b223f784/export 2026-07-30T21:19:41.123842+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "74056ade-c25d-4492-8997-94a4b223f784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mrvab4yvvg24", "content": "~Akamai~\nUnauthenticated RCE in Ruby on Rails Active Storage via libvips allows arbitrary file read and secret extraction.\n-\nIOCs: CVE-2026-66066\n-\n#CVE2026 #RCE #threatintel", "creation_timestamp": "2026-07-30T20:02:46.538606Z"} 2026-07-30T20:02:46.538606+00:00 https://vulnerability.circl.lu/sighting/5847637e-4746-4c48-80b2-16c58904d674/export 2026-07-30T21:19:41.123960+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5847637e-4746-4c48-80b2-16c58904d674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/alon710/91befcf1d9482b0b57392c974c405ba5", "content": "# CVE-2026-66066: CVE-2026-66066: Pre-Authentication Arbitrary File Read and Remote Code Execution in Ruby on Rails Active Storage\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-66066\n\n## Summary\nCVE-2026-66066 (popularly known as 'KindaRails2Shell') is a critical security vulnerability in the Active Storage component of Ruby on Rails. The vulnerability arises from an insecure default integration with the libvips image processing library via the ruby-vips gem. Under default configurations, Active Storage fails to restrict untrusted format loaders within libvips, allowing remote, unauthenticated attackers to upload malformed files that leverage external dataset features to read local server files. By extracting cryptographic secrets such as SECRET_KEY_BASE from the leaked file contents, attackers can forge signed Marshal serialization payloads to achieve remote code execution.\n\n## TL;DR\nActive Storage using libvips allows unauthenticated remote attackers to read arbitrary server files by uploading a crafted MATLAB/HDF5 file, extract SECRET_KEY_BASE, and execute arbitrary commands via forged Marshal deserialization payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1188 / CWE-502\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 9.8\n- **CVSS v4.0 Score**: 9.5\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ruby on Rails (Active Storage / Action Pack) using libvips\n- **Ruby on Rails (Active Storage)**: < 7.2.3.2 (Fixed in: `7.2.3.2`)\n- **Ruby on Rails (Active Storage)**: >= 8.0.0.beta1, < 8.0.5.1 (Fixed in: `8.0.5.1`)\n- **Ruby on Rails (Active Storage)**: >= 8.1.0.beta1, < 8.1.3.1 (Fixed in: `8.1.3.1`)\n\n## Mitigation\n\n- Upgrade the Ruby on Rails framework to patched release versions.\n- Verify and upgrade system-level dependencies for libvips and ruby-vips.\n- Switch the Active Storage variant processor to mini_magick as a temporary workaround.\n- Configure restrictive security policies on host image-processing utilities.\n\n**Remediation Steps:**\n1. Identify the current active variant processor in config/environments/production.rb.\n2. Update Rails Gemfile declarations to target versions 7.2.3.2, 8.0.5.1, or 8.1.3.1.\n3. Ensure host package managers are updated to install libvips version 8.13 or newer.\n4. Update the ruby-vips gem dependency to version 2.2.1 or newer.\n5. Deploy the updated application and restart system-level processes to load the new library-level blocks.\n\n## References\n\n- [GitHub Security Advisory (Rails Core)](https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm)\n- [Official Fix Commit - 1c01bb58](https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e)\n- [Official Fix Commit - 349e7a5d](https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5)\n- [Official Fix Commit - d79b7f4a](https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a)\n- [Rubysec Advisory Entry](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml)\n- [Official Rails Release v7.2.3.2](https://github.com/rails/rails/releases/tag/v7.2.3.2)\n- [Official Rails Release v8.0.5.1](https://github.com/rails/rails/releases/tag/v8.0.5.1)\n- [Official Rails Release v8.1.3.1](https://github.com/rails/rails/releases/tag/v8.1.3.1)\n- [Industry Disclosure](https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-66066) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T19:31:44.957555Z"} 2026-07-30T19:31:44.957555+00:00 https://vulnerability.circl.lu/sighting/f0c92600-63f9-4f40-823a-fa3028114af6/export 2026-07-30T21:19:41.124093+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f0c92600-63f9-4f40-823a-fa3028114af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv4y7uc4a2s", "content": "CVE-2026-66066 - activestorage\nA vulnerability in Active Storage can allow an attacker to read sensitive files and potentially run malicious code on your server. This is possible if your application uses\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#activestorage #Ruby #CVE #infosec", "creation_timestamp": "2026-07-30T19:04:05.642015Z"} 2026-07-30T19:04:05.642015+00:00 https://vulnerability.circl.lu/sighting/d133686b-5ffe-41a9-9f6d-5554bfb37720/export 2026-07-30T21:19:41.124206+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d133686b-5ffe-41a9-9f6d-5554bfb37720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mrv4xkz25x2z", "content": "KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails\n\n", "creation_timestamp": "2026-07-30T19:03:43.987668Z"} 2026-07-30T19:03:43.987668+00:00 https://vulnerability.circl.lu/sighting/99e46b37-eae7-4176-b7c5-a80d4286e5bb/export 2026-07-30T21:19:41.124303+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "99e46b37-eae7-4176-b7c5-a80d4286e5bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mruyttnutg25", "content": "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) https://lobste.rs/s/kkobew #ruby #security ", "creation_timestamp": "2026-07-30T17:50:04.505469Z"} 2026-07-30T17:50:04.505469+00:00 https://vulnerability.circl.lu/sighting/922a30dd-3f83-4398-b17f-c1eee2b04d4c/export 2026-07-30T21:19:41.124400+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "922a30dd-3f83-4398-b17f-c1eee2b04d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyog7d7j2g", "content": "CVE-2026-66066: Containment Strategies or Exploit Research as Priority? #CVE2026 #CyberSecurity #RubyOnRails", "creation_timestamp": "2026-07-30T17:47:02.537405Z"} 2026-07-30T17:47:02.537405+00:00 https://vulnerability.circl.lu/sighting/6d112413-dcfe-46fb-9e1e-e52af2f53998/export 2026-07-30T21:19:41.124493+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6d112413-dcfe-46fb-9e1e-e52af2f53998", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyoei4l425", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Can't Hide Its Lack of Evidence #CVE202666066 #RubyOnRails #Vulnerability", "creation_timestamp": "2026-07-30T17:47:00.360047Z"} 2026-07-30T17:47:00.360047+00:00 https://vulnerability.circl.lu/sighting/1990886d-4db5-4c98-8918-d3e56282e5e0/export 2026-07-30T21:19:41.124590+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "1990886d-4db5-4c98-8918-d3e56282e5e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyoct26u2j", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Signals Serious Compliance Gaps #CVE202666066 #RubyOnRails #Vulnerability", "creation_timestamp": "2026-07-30T17:46:58.748167Z"} 2026-07-30T17:46:58.748167+00:00