Read the docs
TI-2026-47043 Aliases CVE-2026-66066GHSA-xr9x-r78c-5hrm

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Priority HIGH 82CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.32901 98th percentileScored 2026-11-07
Fix Fixed rails (rails): 7.2.3.2, 8.0.5.1, 8.1.3.1activestorage (RubyGems): 7.2.3.2, 8.0.5.1, 8.1.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Railsrailsbefore 7.2.3.2; 8.0.0.beta1 to before 8.0.5.1; 8.1.0.beta1 to before 8.1.3.17.2.3.2, 8.0.5.1, 8.1.3.1Patch availableCNA
—activestorage (RubyGems)before 7.2.3.27.2.3.2Patch availableGHSA-xr9x-r78c-5hrm
—activestorage (RubyGems)8.0.0.beta1 to before 8.0.5.18.0.5.1Patch availableGHSA-xr9x-r78c-5hrm
—activestorage (RubyGems)8.1.0.beta1 to before 8.1.3.18.1.3.1Patch availableGHSA-xr9x-r78c-5hrm
  • rails VendorRails Affected before 7.2.3.2; 8.0.0.beta1 to before 8.0.5.1; 8.1.0.beta1 to before 8.1.3.1 Fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1 Patch available CNA
  • activestorage (RubyGems) Vendor— Affected before 7.2.3.2 Fixed in 7.2.3.2 Patch available GHSA-xr9x-r78c-5hrm
  • activestorage (RubyGems) Vendor— Affected 8.0.0.beta1 to before 8.0.5.1 Fixed in 8.0.5.1 Patch available GHSA-xr9x-r78c-5hrm
  • activestorage (RubyGems) Vendor— Affected 8.1.0.beta1 to before 8.1.3.1 Fixed in 8.1.3.1 Patch available GHSA-xr9x-r78c-5hrm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*——Rails
  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions — — ·Rails

Remediation

  • Fix · CNA rails (rails) Fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1
  • Fix · GHSA-xr9x-r78c-5hrm activestorage (RubyGems) Fixed in 7.2.3.2 Advisory →
  • Fix · GHSA-xr9x-r78c-5hrm activestorage (RubyGems) Fixed in 8.0.5.1 Advisory →
  • Fix · GHSA-xr9x-r78c-5hrm activestorage (RubyGems) Fixed in 8.1.3.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat 3scale API Management Platform 2
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66066
  2. 2026-10-03 Alias added: GHSA-xr9x-r78c-5hrm
  3. 2026-10-08 EPSS moved to the 95th–99th percentile

References

Other 11

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2025-18040 Command injection in Rails activestorage CVSS 4.0CRITICAL 9.2
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
See all 163 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences