Threats Tagged 'cve-2026-66066'
View all threats tagged with 'cve-2026-66066'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-66066'
Click on any threat for detailed analysis and mitigation recommendations
Activestorage: Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing (CVE-2026-66066)CVE-2026-66066 0 Active Storage in Ruby on Rails versions before 7.2.3.2 and certain 8.x versions has a critical vulnerability allowing unauthenticated attackers to read arbitrary files on the server via crafted image uploads processed by libvips. This can expose sensitive environment secrets such as secret_key_base and credentials, potentially leading to remote code execution or lateral movement. The vulnerability arises because Active Storage did not disable unsafe 'unfuzzed' libvips operations by default. Fixed versions of Active Storage and libvips (>= 8.13) are available. Applications must also rotate all secrets if compromise is suspected. Workarounds exist only if libvips >= 8.13 is installed; otherwise, removing libvips is the only option. Join the discussion | GCVE Database | 07/30/2026, 18:23:33 UTC Added: 07/30/2026, 23:28:33 UTC |
Showing 1 to 1 of 1 result