{"action":"Upgrade activestorage to 7.2.3.2 or later.","affected":[{"fixed":"7.2.3.2","introduced":"0"},{"fixed":"8.0.5.1","introduced":"8.0.0.beta1"},{"fixed":"8.1.3.1","introduced":"8.1.0.beta1"}],"component":"activestorage","cve_ids":["CVE-2026-66066"],"ecosystem":"RubyGems","epss":0.32901,"exploited":false,"fixed_versions":["7.2.3.2","8.0.5.1","8.1.3.1"],"ghsa_id":"GHSA-xr9x-r78c-5hrm","id":"tcs_01M5KEPARTVCJVZTGYHNBD1VAX","modified_at":"2026-09-10T03:51:12.686410422Z","published_at":"2026-07-30T18:23:33Z","references":["https://osv.dev/vulnerability/GHSA-xr9x-r78c-5hrm","https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm","https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e","https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5","https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a","https://github.com/rails/rails","https://github.com/rails/rails/releases/tag/v7.2.3.2","https://github.com/rails/rails/releases/tag/v8.0.5.1","https://github.com/rails/rails/releases/tag/v8.1.3.1","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml","https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html","https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066"],"severity":{"label":"critical","score":9.5},"sources":[{"source":"osv","source_id":"GHSA-xr9x-r78c-5hrm","url":"https://osv.dev/vulnerability/GHSA-xr9x-r78c-5hrm"},{"source":"nvd","source_id":"CVE-2026-66066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66066"}],"summary":"Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing"}