CVE-2026-66066
1 advisory.
RubyGems/activestorage CVE-2026-66066: critical
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
Action: Upgrade activestorage to 7.2.3.2 or later.
bundle update activestorageAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.2.3.2 | - |
| 8.0.0.beta1 | 8.0.5.1 | - |
| 8.1.0.beta1 | 8.1.3.1 | - |
Fixed versions
| 7.2.3.2 | 8.0.5.1 | 8.1.3.1 |
Sources
- osv: GHSA-xr9x-r78c-5hrm
- https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
- https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e
- https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5
- https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a
- https://github.com/rails/rails
- https://github.com/rails/rails/releases/tag/v7.2.3.2
- https://github.com/rails/rails/releases/tag/v8.0.5.1
- https://github.com/rails/rails/releases/tag/v8.1.3.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml
- https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066
CVE-2026-66066 · published · modified · JSON