https://vulnerability.circl.lu/sightings/feed 2026-09-12T16:40:18.882578+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c278e86d-3aac-4454-85e5-8d631ebd83d3/export 2026-09-12T16:40:18.916295+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c278e86d-3aac-4454-85e5-8d631ebd83d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_activestorage_vips_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, ruby\", \"author\": [\"0xacb\", \"s3np41k1r1t0\", \"castilho\", \"RyotaK\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2026-66066 in Ruby on Rails Active Storage when\\n the application uses the Vips variant processor and accepts untrusted image\\n uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text\\n files accessible to the Rails worker through a PNG representation response.\\n\\n The module recovers secret_key_base from the process environment, Rails local\\n secrets, encrypted credentials, or the legacy secrets.yml(.enc) files. It then\\n forges a serializer-compatible variation whose ImageProcessing apply step reaches\\n Kernel#spawn with a command payload, or Kernel#eval with a native Ruby payload when\\n the Ruby target is selected. Neither path requires a Marshal object gadget. The\\n Ruby target's initial code execution does not require a Unix shell or a fetch\\n utility on the target.\\n\\n The file-read stage needs a genuine signed Active Storage variation key. It can use\\n VARIATION_KEY directly, reuse a representation URL from the application, or create\\n one through an application upload form. Supplying SECRET_KEY_BASE skips the\\n arbitrary file-read stage and lets the module construct the standard\\n representation route itself.\\n\\n The file-read stage affects Rails 6.0 and 6.1, Rails 7.0 through 7.2.3.1,\\n Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. It is fixed in\\n Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. The RCE stage combines an incomplete\\n Vips-side fix for CVE-2025-24293 with ImageProcessing 1.x method dispatch;\\n ImageProcessing 2.x blocks this chain.\", \"disclosure_date\": \"2026-07-29\", \"fullname\": \"exploit/multi/http/rails_activestorage_vips_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-25 11:44:52 +0000\", \"name\": \"Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/multi/http/rails_activestorage_vips_rce.rb\", \"platform\": \"Linux,Ruby,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/http/rails_activestorage_vips_rce\", \"references\": [\"CVE-2026-66066\", \"GHSA-xr9x-r78c-5hrm\", \"CVE-2025-24293\", \"GHSA-r4mg-4433-c7g3\", \"URL-https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails\", \"URL-https://blog.flatt.tech/entry/kindarails2shell_rails\", \"URL-https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/\", \"URL-https://github.com/rails/rails/pull/56995\", \"URL-https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441\", \"URL-https://github.com/rails/rails-forensics-CVE-2026-66066\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux/Unix Command\", \"Ruby\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:10.356965Z"} 2026-09-08T06:50:10.356965+00:00 https://vulnerability.circl.lu/sighting/9be9e17e-8f28-4cb2-a15e-47927faf6b9d/export 2026-09-12T16:40:18.919613+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9be9e17e-8f28-4cb2-a15e-47927faf6b9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/PZ4h1bEYzQUZNpz5jejfcfkAUPMGmF2SrshkVKYlc3YG-0E", "content": "", "creation_timestamp": "2026-09-08T00:01:01.912519Z"} 2026-09-08T00:01:01.912519+00:00 https://vulnerability.circl.lu/sighting/fbf397a1-37ee-4828-8fd4-05de3026fc5c/export 2026-09-12T16:40:18.919792+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "fbf397a1-37ee-4828-8fd4-05de3026fc5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/PZ4h1bEYzQUZNpz5jejfcfkAUPMGmF2SrshkVKYlc3YG-0E", "content": "", "creation_timestamp": "2026-09-07T04:00:05.002242Z"} 2026-09-07T04:00:05.002242+00:00 https://vulnerability.circl.lu/sighting/8bc3e5f9-c524-427d-99a2-f14e2b55a0d0/export 2026-09-12T16:40:18.919906+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8bc3e5f9-c524-427d-99a2-f14e2b55a0d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muueareqa22c", "content": "The half of CVE-2026-66066 people are skipping: it is an arbitrary read of the process environment.\n\nIf you were exposed at all, secret_key_base and your service credentials are leaked whether or not you have patched since. Patch, then rotate, then go look.\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:57:04.145471Z"} 2026-09-06T15:57:04.145471+00:00 https://vulnerability.circl.lu/sighting/734022b9-e421-4f40-bd53-6c30dfb85f81/export 2026-09-12T16:40:18.920016+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "734022b9-e421-4f40-bd53-6c30dfb85f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muue3g2fp42i", "content": "Three checks that prove you closed CVE-2026-66066, not just bumped the gem:\n\nvips --version -> needs 8.13+\nbundle list | grep activestorage\nbin/rails runner 'puts :ok'\n\nThe third matters. Patched Active Storage refuses to boot on old libvips rather than run unsecurable.\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:54:04.425770Z"} 2026-09-06T15:54:04.425770+00:00 https://vulnerability.circl.lu/sighting/83314020-e8c4-4d62-be91-9409c09525da/export 2026-09-12T16:40:18.920124+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "83314020-e8c4-4d62-be91-9409c09525da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muudqjl7k22z", "content": "CVE-2026-66066 is being probed in the wild. Active Storage + libvips, CVSS 9.5, arbitrary file read.\n\nTriage:\n\u2022 bundle list | grep -E \"activestorage|ruby-vips\"\n\u2022 patched: 7.2.3.2 / 8.0.5.1 / 8.1.3.1\n\u2022 can\u2019t deploy today? Vips.block_untrusted(true) in an initializer\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:47:59.090086Z"} 2026-09-06T15:47:59.090086+00:00 https://vulnerability.circl.lu/sighting/cfc982f6-ea9d-45d2-a1c5-adf97827064a/export 2026-09-12T16:40:18.920224+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "cfc982f6-ea9d-45d2-a1c5-adf97827064a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3murlkhppba2l", "content": "Rietta successfully mitigated a critical Ruby on Rails ActiveStorage vulnerability (CVE-2026-66066) by deploying emergency patches before exploitation attempts began. Their experience highlights that public code fixes often trigger rapid attacks, rendering embargoed disclosures ineffective.", "creation_timestamp": "2026-09-05T13:29:46.963519Z"} 2026-09-05T13:29:46.963519+00:00 https://vulnerability.circl.lu/sighting/fcd9a9fe-1188-449b-bea6-f5c06b9f4870/export 2026-09-12T16:40:18.920328+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "fcd9a9fe-1188-449b-bea6-f5c06b9f4870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3murjvf5gvp2u", "content": "\ud83d\udce2 CVE-2026-66066 : exploitation d'une RCE ActiveStorage (Rails) quelques heures apr\u00e8s le patch\n\nCet article est un post-mortem d\u00e9taill\u00e9 d'un incident de s\u00e9curit\u00e9 impliquant la CVE-2026-66066 (alias KindaRails2Shell), une\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#ActiveStorage #RCE #Cyberveille", "creation_timestamp": "2026-09-05T13:00:05.678236Z"} 2026-09-05T13:00:05.678236+00:00 https://vulnerability.circl.lu/sighting/734641eb-d392-402c-8f32-4d7466c21069/export 2026-09-12T16:40:18.920428+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "734641eb-d392-402c-8f32-4d7466c21069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/tiff.bunny.blue.ap.brid.gy/post/3mupuictwntq2", "content": "huh maybe mastodon's delayed migration from paperclip to activestorage saved us from CVE-2026-66066", "creation_timestamp": "2026-09-04T21:04:27.165382Z"} 2026-09-04T21:04:27.165382+00:00 https://vulnerability.circl.lu/sighting/c61736ac-e6f7-45e8-82e2-bd75c6543f6c/export 2026-09-12T16:40:18.920523+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c61736ac-e6f7-45e8-82e2-bd75c6543f6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/48033", "content": "CVE-2026-66066 in Ruby on Rails\n*\nStorage file-read-to-RCE chain\n\n*\nPoC", "creation_timestamp": "2026-09-03T00:00:52.514524Z"} 2026-09-03T00:00:52.514524+00:00