Vulnerability-Lookup

GHSA-XR9X-R78C-5HRM

Vulnerability from github – Published: 2026-07-30 18:23 – Updated: 2026-07-30 18:23

Summary

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Details

Impact

In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret_key_base and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.

Details

libvips reads and writes file formats through "loaders" and "savers" (or more generally "operations"), many of which are backed by third-party libraries. It marks some of these operations as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats unrelated to web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload a crafted file and cause a variant to be generated from it may be able to invoke one.

We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application. One specific attack chain has been reported to us (see "Disclosure" below), but we do not assume it is the only one that exists.

Affected applications

An application is affected if it meets all of these requirements: - Uses libvips for Active Storage image processing. This is config.active_storage.variant_processor = :vips, which load_defaults 7.0 set and no later default has changed. - Allows image uploads from untrusted users.

Generating variants is not a separate requirement.

Mitigation

Upgrade to a fixed version of activestorage.
The minimum version of libvips must be upgraded to >= 8.13.
Change secret_key_base and change any secrets accessible in the application environment (see "Expire and change secrets" below)

Earlier versions of libvips (< 8.13) cannot disable unfuzzed operations at all, and Active Storage will raise an exception during boot in such an unsecurable environment.

Expire and change secrets

Upgrading closes the vulnerability but does not undo an exfiltrated secret if that already occurred. An affected application should treat every secret readable by the application process as potentially exposed and change it, including:

secret_key_base
The master key, whether stored in config/master.key or supplied as RAILS_MASTER_KEY, along with everything in config/credentials.yml.enc that it decrypts
Credentials for the Active Storage service, such as S3, GCS, or Azure keys
Database credentials
Tokens and keys for any third-party service the application calls

Changing secret_key_base expires active sessions and requires users to log in again. Encrypted cookies, signed cookies, signed global IDs, and Active Storage URLs are also affected.

Rotation should only be used as an intermediate step if necessary. Do not retain an exposed secret as a fallback.

Workarounds

If libvips < 8.13 is being used, there are no workarounds available other than removing the dependency on libvips from the application. Some applications may have ruby-vips declared as a dependency only for image analysis, and those applications may be able to simply remove ruby-vips from the Gemfile to remove libvips from the application. Applications that do not use Active Storage can remove ruby-vips from the Gemfile to avoid the boot-time checks.

If libvips >= 8.13 is present on the system, applications can disable the unfuzzed operations without upgrading Rails by setting the VIPS_BLOCK_UNTRUSTED environment variable, which libvips reads while initializing.

Applications also running ruby-vips >= 2.2.1 or later can instead call Vips.block_untrusted(true) from an initializer.

Releases

The fixed releases are available at the normal locations.

Versions affected

activestorage < 7.2.3.2
activestorage >= 8.0, < 8.0.5.1
activestorage >= 8.1, < 8.1.3.1

Disclosure

Technical details of the attack chain are intentionally omitted from this advisory. They would add nothing to an administrator's decision to upgrade, while making it substantially easier to attack applications that have not yet done so.

Details will be disclosed no later than 2026-08-28, via the Rails Security Announcements forum.

Credit

This issue was responsibly reported by 0xacb, s3np41k1r1t0 and castilho from Ethiack, and RyotaK from GMO Flatt Security Inc..

References

libvips 8.13 release notes, blocking of unfuzzed loaders
W.A. Arbaugh, W.L. Fithen, and J. McHugh, "Windows of Vulnerability: A Case Study Analysis", IEEE Computer 33(12), December 2000
https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve
https://blog.flatt.tech/entry/kindarails2shell_rails

Severity

9.5 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0.beta1"
            },
            {
              "fixed": "8.0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0.beta1"
            },
            {
              "fixed": "8.1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-66066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T18:23:33Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\nIn its default configuration, a Rails application that displays image variants may allow an\nunauthenticated attacker to read arbitrary files from the server, including the process environment.\nThat environment typically holds `secret_key_base` and often credentials for external systems, which\nmay in turn allow escalation to remote code execution or lateral movement to those systems.\n\n### Details\nlibvips reads and writes file formats through \"loaders\" and \"savers\" (or more generally\n\"operations\"), many of which are backed by third-party libraries. It marks some of these operations\nas \"unfuzzed\", meaning they are unsafe for untrusted content, and several handle formats unrelated\nto web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload\na crafted file and cause a variant to be generated from it may be able to invoke one.\n\nWe are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause\ndisclosure of the contents of arbitrary files accessible on the filesystem of the targeted\napplication. One specific attack chain has been reported to us (see \"Disclosure\" below), but we do\nnot assume it is the only one that exists.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Uses libvips for Active Storage image processing. This is `config.active_storage.variant_processor = :vips`,\n  which `load_defaults 7.0` set and no later default has changed.\n- Allows image uploads from untrusted users.\n\nGenerating variants is not a separate requirement.\n\n### Mitigation\n- Upgrade to a fixed version of `activestorage`.\n- The minimum version of libvips must be upgraded to `\u003e= 8.13`.\n- Change `secret_key_base` and change any secrets accessible in the application environment (see \"Expire and change secrets\" below)\n\nEarlier versions of libvips (`\u003c 8.13`) cannot disable unfuzzed operations at all, and Active Storage\nwill raise an exception during boot in such an unsecurable environment.\n\n### Expire and change secrets\n\nUpgrading closes the vulnerability but does not undo an exfiltrated secret if that already\noccurred. An affected application should treat every secret readable by the application process as\npotentially exposed and change it, including:\n\n- `secret_key_base`\n- The master key, whether stored in `config/master.key` or supplied as `RAILS_MASTER_KEY`, along\n  with everything in `config/credentials.yml.enc` that it decrypts\n- Credentials for the Active Storage service, such as S3, GCS, or Azure keys\n- Database credentials\n- Tokens and keys for any third-party service the application calls\n\nChanging `secret_key_base` expires active sessions and requires users to log in again. Encrypted\ncookies, signed cookies, signed global IDs, and Active Storage URLs are also affected.\n\nRotation should only be used as an intermediate step if necessary. Do not retain an exposed secret\nas a fallback.\n\n### Workarounds\nIf libvips `\u003c 8.13` is being used, there are no workarounds available other than removing the\ndependency on libvips from the application. Some applications may have `ruby-vips` declared as a\ndependency only for image analysis, and those applications may be able to simply remove `ruby-vips`\nfrom the Gemfile to remove libvips from the application. Applications that do not use Active Storage\ncan remove `ruby-vips` from the Gemfile to avoid the boot-time checks.\n\nIf libvips `\u003e= 8.13` is present on the system, applications can disable the unfuzzed operations\nwithout upgrading Rails by setting the `VIPS_BLOCK_UNTRUSTED` environment variable, which libvips\nreads while initializing.\n\nApplications also running ruby-vips `\u003e= 2.2.1` or later can instead call\n`Vips.block_untrusted(true)` from an initializer.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\n### Versions affected\n\n- activestorage \u003c 7.2.3.2\n- activestorage \u003e= 8.0, \u003c 8.0.5.1\n- activestorage \u003e= 8.1, \u003c 8.1.3.1\n\n### Disclosure\nTechnical details of the attack chain are intentionally omitted from this advisory. They would add\nnothing to an administrator\u0027s decision to upgrade, while making it substantially easier to attack\napplications that have not yet done so.\n\nDetails will be disclosed no later than 2026-08-28, via the [Rails Security\nAnnouncements](https://discuss.rubyonrails.org/c/security-announcements/9) forum.\n\n### Credit\nThis issue was responsibly reported by [0xacb](https://x.com/0xacb), [s3np41k1r1t0](https://x.com/s3np41k1r1t0) and [castilho](https://x.com/castilho101) from [Ethiack](https://ethiack.com), and [RyotaK](https://ryotak.net) from [GMO Flatt Security Inc.](https://flatt.tech/en/).\n\n### References\n- libvips 8.13 release notes, [blocking of unfuzzed loaders](https://www.libvips.org/2022/05/28/What\u0027s-new-in-8.13.html#blocking-of-unfuzzed-loaders)\n- W.A. Arbaugh, W.L. Fithen, and J. McHugh, [\"Windows of Vulnerability: A Case Study\n  Analysis\"](https://doi.org/10.1109/2.889093), IEEE Computer 33(12), December 2000\n- https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve\n- https://blog.flatt.tech/entry/kindarails2shell_rails",
  "id": "GHSA-xr9x-r78c-5hrm",
  "modified": "2026-07-30T18:23:33Z",
  "published": "2026-07-30T18:23:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rails/rails"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v7.2.3.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v8.0.5.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v8.1.3.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml"
    },
    {
      "type": "WEB",
      "url": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing"
}

CVE-2026-66066 (GCVE-0-2026-66066)

Vulnerability from cvelistv5 – Published: 2026-07-30 18:32 – Updated: 2026-07-30 19:16

Title

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Summary

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Severity

9.5 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M

References

10 references

URL	Tags
https://github.com/rails/rails/security/advisorie…	x_refsource_CONFIRM
https://github.com/rails/rails/commit/1c01bb58720…	x_refsource_MISC
https://github.com/rails/rails/commit/349e7a5d5b4…	x_refsource_MISC
https://github.com/rails/rails/commit/d79b7f4aa17…	x_refsource_MISC
https://github.com/rails/rails/releases/tag/v7.2.3.2	x_refsource_MISC
https://github.com/rails/rails/releases/tag/v8.0.5.1	x_refsource_MISC
https://github.com/rails/rails/releases/tag/v8.1.3.1	x_refsource_MISC
https://github.com/rubysec/ruby-advisory-db/blob/…	x_refsource_MISC
https://thehackernews.com/2026/07/critical-rails-…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/07/29/9

Impacted products

1 product

Vendor	Product	Version
rails	rails	Affected: < 7.2.3.2 Affected: >= 8.0.0.beta1, < 8.0.5.1 Affected: >= 8.1.0.beta1, < 8.1.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-30T18:35:38.631Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/29/9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66066",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T19:16:09.405495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T19:16:14.471Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rails",
          "vendor": "rails",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.2.3.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0.beta1, \u003c 8.0.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0.beta1, \u003c 8.1.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.5,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T18:32:11.419Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm"
        },
        {
          "name": "https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e"
        },
        {
          "name": "https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5"
        },
        {
          "name": "https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a"
        },
        {
          "name": "https://github.com/rails/rails/releases/tag/v7.2.3.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rails/rails/releases/tag/v7.2.3.2"
        },
        {
          "name": "https://github.com/rails/rails/releases/tag/v8.0.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rails/rails/releases/tag/v8.0.5.1"
        },
        {
          "name": "https://github.com/rails/rails/releases/tag/v8.1.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rails/rails/releases/tag/v8.1.3.1"
        },
        {
          "name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml"
        },
        {
          "name": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html"
        }
      ],
      "source": {
        "advisory": "GHSA-xr9x-r78c-5hrm",
        "discovery": "UNKNOWN"
      },
      "title": "Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-66066",
    "datePublished": "2026-07-30T18:32:11.419Z",
    "dateReserved": "2026-07-23T23:25:28.897Z",
    "dateUpdated": "2026-07-30T19:16:14.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-XR9X-R78C-5HRM

Impact

Details

Affected applications

Mitigation

Expire and change secrets

Workarounds

Releases

Versions affected

Disclosure

Credit

References

CVE-2026-66066 (GCVE-0-2026-66066)

Tags

Sightings

Nomenclature