CVE-2026-66066rails Unrestricted File Upload
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
Published Jul 30, 2026 · Updated Sep 12, 2026 · Also known as DEBIAN-CVE-2026-66066, GHSA-xr9x-r78c-5hrm, UBUNTU-CVE-2026-66066
Key Facts
Patch immediately- CVE-2026-66066 is a critical-severity vulnerability (CVSS 9.5 v4) affecting gitlab-rails-ce-18.10 (chainguard), gitlab-rails-ce-18.11 (chainguard), gitlab-rails-ce-18.8 (chainguard) and 12 more products.
- It is exploited in the wild, listed in Industry KEV feed since Aug 25, 2026. Public exploit code is available.
- EPSS estimates a 28% probability of exploitation in the next 30 days.
- Fixed versions are available, including activestorage 7.2.3.2, activestorage 8.0.5.1, activestorage 8.1.3.1.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v4
9.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (30-day exploit likelihood)
28%
Higher than 98.0% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
56/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Aug 25, 2026
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
5
Reports of active use
Advisories And Exploit References
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2026-66066
- advisoryhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-66066
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2026-66066
- advisoryhttps://ubuntu.com/security/CVE-2026-66066
- advisoryhttps://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066
Description
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users.
An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Aug 25, 2026 | n/a | Not reported |
Affected Products
31 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| gitlab-rails-ce-18.10chainguard | See advisory | 18.10.8-r6 |
| gitlab-rails-ce-18.11chainguard | See advisory | 18.11.8-r0 |
| gitlab-rails-ce-18.8chainguard | See advisory | 18.8.11-r4 |
| gitlab-rails-ce-18.9chainguard | See advisory | 18.9.8-r7 |
| gitlab-rails-ce-19.0chainguard | See advisory | 19.0.5-r0 |
Patched Releases
activestorage
7.2.3.2, 8.0.5.1, 8.1.3.1
gitlab-rails-ce-18.10
18.10.8-r6
gitlab-rails-ce-18.11
18.11.8-r0
gitlab-rails-ce-18.8
18.8.11-r4
gitlab-rails-ce-18.9
18.9.8-r7
gitlab-rails-ce-19.0
19.0.5-r0
gitlab-rails-ce-fips-18.10
18.10.8-r7
gitlab-rails-ce-fips-18.11
18.11.8-r0
gitlab-rails-ce-fips-19.0
19.0.4-r9
gitlab-rails-ce-fips-19.2
19.2.1-r0
pghero
3.8.0-r3
pghero-fips
3.8.0-r3
rails
2:6.1.7.10+dfsg-1~deb12u3, 2:7.2.2.2+dfsg-2~deb13u2, 2:7.2.3.2+dfsg-1
ruby3.3-rails-8.0
8.0.5.1-r0
Timeline
Publicly disclosed
Jul 30, 2026
Added to Industry KEV feed
Aug 25, 2026
Last updated
Sep 12, 2026
Weakness Type
- CWE-434 Unrestricted Upload of File with Dangerous Type
- CWE-1188 Initialization of a Resource with an Insecure Default
References
- advisorycve.org · CVERecord
- advisoryhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml
- advisorynvd.nist.gov · CVE-2026-66066
- advisorysecurity-tracker.debian.org · CVE-2026-66066
- advisoryubuntu.com · CVE-2026-66066
FAQ
Common Questions.
Action Pack is a framework for handling and responding to web requests.
Affected: gitlab-rails-ce-18.10 (chainguard); gitlab-rails-ce-18.11 (chainguard); gitlab-rails-ce-18.8 (chainguard), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Aug 25, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including activestorage 7.2.3.2, activestorage 8.0.5.1, activestorage 8.1.3.1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-66066 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo