https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 12 Sep 2026 16:26:00 +0000 https://vulnerability.circl.lu/sighting/c278e86d-3aac-4454-85e5-8d631ebd83d3/export {"uuid": "c278e86d-3aac-4454-85e5-8d631ebd83d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_activestorage_vips_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, ruby\", \"author\": [\"0xacb\", \"s3np41k1r1t0\", \"castilho\", \"RyotaK\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2026-66066 in Ruby on Rails Active Storage when\\n the application uses the Vips variant processor and accepts untrusted image\\n uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text\\n files accessible to the Rails worker through a PNG representation response.\\n\\n The module recovers secret_key_base from the process environment, Rails local\\n secrets, encrypted credentials, or the legacy secrets.yml(.enc) files. It then\\n forges a serializer-compatible variation whose ImageProcessing apply step reaches\\n Kernel#spawn with a command payload, or Kernel#eval with a native Ruby payload when\\n the Ruby target is selected. Neither path requires a Marshal object gadget. The\\n Ruby target's initial code execution does not require a Unix shell or a fetch\\n utility on the target.\\n\\n The file-read stage needs a genuine signed Active Storage variation key. It can use\\n VARIATION_KEY directly, reuse a representation URL from the application, or create\\n one through an application upload form. Supplying SECRET_KEY_BASE skips the\\n arbitrary file-read stage and lets the module construct the standard\\n representation route itself.\\n\\n The file-read stage affects Rails 6.0 and 6.1, Rails 7.0 through 7.2.3.1,\\n Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. It is fixed in\\n Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. The RCE stage combines an incomplete\\n Vips-side fix for CVE-2025-24293 with ImageProcessing 1.x method dispatch;\\n ImageProcessing 2.x blocks this chain.\", \"disclosure_date\": \"2026-07-29\", \"fullname\": \"exploit/multi/http/rails_activestorage_vips_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-25 11:44:52 +0000\", \"name\": \"Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/multi/http/rails_activestorage_vips_rce.rb\", \"platform\": \"Linux,Ruby,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/http/rails_activestorage_vips_rce\", \"references\": [\"CVE-2026-66066\", \"GHSA-xr9x-r78c-5hrm\", \"CVE-2025-24293\", \"GHSA-r4mg-4433-c7g3\", \"URL-https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails\", \"URL-https://blog.flatt.tech/entry/kindarails2shell_rails\", \"URL-https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/\", \"URL-https://github.com/rails/rails/pull/56995\", \"URL-https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441\", \"URL-https://github.com/rails/rails-forensics-CVE-2026-66066\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux/Unix Command\", \"Ruby\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:10.356965Z"} {"uuid": "c278e86d-3aac-4454-85e5-8d631ebd83d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_activestorage_vips_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, ruby\", \"author\": [\"0xacb\", \"s3np41k1r1t0\", \"castilho\", \"RyotaK\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2026-66066 in Ruby on Rails Active Storage when\\n the application uses the Vips variant processor and accepts untrusted image\\n uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text\\n files accessible to the Rails worker through a PNG representation response.\\n\\n The module recovers secret_key_base from the process environment, Rails local\\n secrets, encrypted credentials, or the legacy secrets.yml(.enc) files. It then\\n forges a serializer-compatible variation whose ImageProcessing apply step reaches\\n Kernel#spawn with a command payload, or Kernel#eval with a native Ruby payload when\\n the Ruby target is selected. Neither path requires a Marshal object gadget. The\\n Ruby target's initial code execution does not require a Unix shell or a fetch\\n utility on the target.\\n\\n The file-read stage needs a genuine signed Active Storage variation key. It can use\\n VARIATION_KEY directly, reuse a representation URL from the application, or create\\n one through an application upload form. Supplying SECRET_KEY_BASE skips the\\n arbitrary file-read stage and lets the module construct the standard\\n representation route itself.\\n\\n The file-read stage affects Rails 6.0 and 6.1, Rails 7.0 through 7.2.3.1,\\n Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. It is fixed in\\n Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. The RCE stage combines an incomplete\\n Vips-side fix for CVE-2025-24293 with ImageProcessing 1.x method dispatch;\\n ImageProcessing 2.x blocks this chain.\", \"disclosure_date\": \"2026-07-29\", \"fullname\": \"exploit/multi/http/rails_activestorage_vips_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-25 11:44:52 +0000\", \"name\": \"Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/multi/http/rails_activestorage_vips_rce.rb\", \"platform\": \"Linux,Ruby,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/http/rails_activestorage_vips_rce\", \"references\": [\"CVE-2026-66066\", \"GHSA-xr9x-r78c-5hrm\", \"CVE-2025-24293\", \"GHSA-r4mg-4433-c7g3\", \"URL-https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails\", \"URL-https://blog.flatt.tech/entry/kindarails2shell_rails\", \"URL-https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/\", \"URL-https://github.com/rails/rails/pull/56995\", \"URL-https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441\", \"URL-https://github.com/rails/rails-forensics-CVE-2026-66066\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux/Unix Command\", \"Ruby\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:10.356965Z"} https://vulnerability.circl.lu/sighting/c278e86d-3aac-4454-85e5-8d631ebd83d3/export Tue, 08 Sep 2026 06:50:10 +0000 https://vulnerability.circl.lu/sighting/9be9e17e-8f28-4cb2-a15e-47927faf6b9d/export {"uuid": "9be9e17e-8f28-4cb2-a15e-47927faf6b9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/PZ4h1bEYzQUZNpz5jejfcfkAUPMGmF2SrshkVKYlc3YG-0E", "content": "", "creation_timestamp": "2026-09-08T00:01:01.912519Z"} {"uuid": "9be9e17e-8f28-4cb2-a15e-47927faf6b9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/PZ4h1bEYzQUZNpz5jejfcfkAUPMGmF2SrshkVKYlc3YG-0E", "content": "", "creation_timestamp": "2026-09-08T00:01:01.912519Z"} https://vulnerability.circl.lu/sighting/9be9e17e-8f28-4cb2-a15e-47927faf6b9d/export Tue, 08 Sep 2026 00:01:01 +0000 https://vulnerability.circl.lu/sighting/fbf397a1-37ee-4828-8fd4-05de3026fc5c/export {"uuid": "fbf397a1-37ee-4828-8fd4-05de3026fc5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/PZ4h1bEYzQUZNpz5jejfcfkAUPMGmF2SrshkVKYlc3YG-0E", "content": "", "creation_timestamp": "2026-09-07T04:00:05.002242Z"} {"uuid": "fbf397a1-37ee-4828-8fd4-05de3026fc5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/PZ4h1bEYzQUZNpz5jejfcfkAUPMGmF2SrshkVKYlc3YG-0E", "content": "", "creation_timestamp": "2026-09-07T04:00:05.002242Z"} https://vulnerability.circl.lu/sighting/fbf397a1-37ee-4828-8fd4-05de3026fc5c/export Mon, 07 Sep 2026 04:00:05 +0000 https://vulnerability.circl.lu/sighting/8bc3e5f9-c524-427d-99a2-f14e2b55a0d0/export {"uuid": "8bc3e5f9-c524-427d-99a2-f14e2b55a0d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muueareqa22c", "content": "The half of CVE-2026-66066 people are skipping: it is an arbitrary read of the process environment.\n\nIf you were exposed at all, secret_key_base and your service credentials are leaked whether or not you have patched since. Patch, then rotate, then go look.\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:57:04.145471Z"} {"uuid": "8bc3e5f9-c524-427d-99a2-f14e2b55a0d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muueareqa22c", "content": "The half of CVE-2026-66066 people are skipping: it is an arbitrary read of the process environment.\n\nIf you were exposed at all, secret_key_base and your service credentials are leaked whether or not you have patched since. Patch, then rotate, then go look.\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:57:04.145471Z"} https://vulnerability.circl.lu/sighting/8bc3e5f9-c524-427d-99a2-f14e2b55a0d0/export Sun, 06 Sep 2026 15:57:04 +0000 https://vulnerability.circl.lu/sighting/734022b9-e421-4f40-bd53-6c30dfb85f81/export {"uuid": "734022b9-e421-4f40-bd53-6c30dfb85f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muue3g2fp42i", "content": "Three checks that prove you closed CVE-2026-66066, not just bumped the gem:\n\nvips --version -> needs 8.13+\nbundle list | grep activestorage\nbin/rails runner 'puts :ok'\n\nThe third matters. Patched Active Storage refuses to boot on old libvips rather than run unsecurable.\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:54:04.425770Z"} {"uuid": "734022b9-e421-4f40-bd53-6c30dfb85f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muue3g2fp42i", "content": "Three checks that prove you closed CVE-2026-66066, not just bumped the gem:\n\nvips --version -> needs 8.13+\nbundle list | grep activestorage\nbin/rails runner 'puts :ok'\n\nThe third matters. Patched Active Storage refuses to boot on old libvips rather than run unsecurable.\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:54:04.425770Z"} https://vulnerability.circl.lu/sighting/734022b9-e421-4f40-bd53-6c30dfb85f81/export Sun, 06 Sep 2026 15:54:04 +0000 https://vulnerability.circl.lu/sighting/83314020-e8c4-4d62-be91-9409c09525da/export {"uuid": "83314020-e8c4-4d62-be91-9409c09525da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muudqjl7k22z", "content": "CVE-2026-66066 is being probed in the wild. Active Storage + libvips, CVSS 9.5, arbitrary file read.\n\nTriage:\n\u2022 bundle list | grep -E \"activestorage|ruby-vips\"\n\u2022 patched: 7.2.3.2 / 8.0.5.1 / 8.1.3.1\n\u2022 can\u2019t deploy today? Vips.block_untrusted(true) in an initializer\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:47:59.090086Z"} {"uuid": "83314020-e8c4-4d62-be91-9409c09525da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muudqjl7k22z", "content": "CVE-2026-66066 is being probed in the wild. Active Storage + libvips, CVSS 9.5, arbitrary file read.\n\nTriage:\n\u2022 bundle list | grep -E \"activestorage|ruby-vips\"\n\u2022 patched: 7.2.3.2 / 8.0.5.1 / 8.1.3.1\n\u2022 can\u2019t deploy today? Vips.block_untrusted(true) in an initializer\n\n#RubyOnRails #Rails", "creation_timestamp": "2026-09-06T15:47:59.090086Z"} https://vulnerability.circl.lu/sighting/83314020-e8c4-4d62-be91-9409c09525da/export Sun, 06 Sep 2026 15:47:59 +0000 https://vulnerability.circl.lu/sighting/cfc982f6-ea9d-45d2-a1c5-adf97827064a/export {"uuid": "cfc982f6-ea9d-45d2-a1c5-adf97827064a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3murlkhppba2l", "content": "Rietta successfully mitigated a critical Ruby on Rails ActiveStorage vulnerability (CVE-2026-66066) by deploying emergency patches before exploitation attempts began. Their experience highlights that public code fixes often trigger rapid attacks, rendering embargoed disclosures ineffective.", "creation_timestamp": "2026-09-05T13:29:46.963519Z"} {"uuid": "cfc982f6-ea9d-45d2-a1c5-adf97827064a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3murlkhppba2l", "content": "Rietta successfully mitigated a critical Ruby on Rails ActiveStorage vulnerability (CVE-2026-66066) by deploying emergency patches before exploitation attempts began. Their experience highlights that public code fixes often trigger rapid attacks, rendering embargoed disclosures ineffective.", "creation_timestamp": "2026-09-05T13:29:46.963519Z"} https://vulnerability.circl.lu/sighting/cfc982f6-ea9d-45d2-a1c5-adf97827064a/export Sat, 05 Sep 2026 13:29:46 +0000 https://vulnerability.circl.lu/sighting/fcd9a9fe-1188-449b-bea6-f5c06b9f4870/export {"uuid": "fcd9a9fe-1188-449b-bea6-f5c06b9f4870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3murjvf5gvp2u", "content": "\ud83d\udce2 CVE-2026-66066 : exploitation d'une RCE ActiveStorage (Rails) quelques heures apr\u00e8s le patch\n\nCet article est un post-mortem d\u00e9taill\u00e9 d'un incident de s\u00e9curit\u00e9 impliquant la CVE-2026-66066 (alias KindaRails2Shell), une\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#ActiveStorage #RCE #Cyberveille", "creation_timestamp": "2026-09-05T13:00:05.678236Z"} {"uuid": "fcd9a9fe-1188-449b-bea6-f5c06b9f4870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3murjvf5gvp2u", "content": "\ud83d\udce2 CVE-2026-66066 : exploitation d'une RCE ActiveStorage (Rails) quelques heures apr\u00e8s le patch\n\nCet article est un post-mortem d\u00e9taill\u00e9 d'un incident de s\u00e9curit\u00e9 impliquant la CVE-2026-66066 (alias KindaRails2Shell), une\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#ActiveStorage #RCE #Cyberveille", "creation_timestamp": "2026-09-05T13:00:05.678236Z"} https://vulnerability.circl.lu/sighting/fcd9a9fe-1188-449b-bea6-f5c06b9f4870/export Sat, 05 Sep 2026 13:00:05 +0000 https://vulnerability.circl.lu/sighting/734641eb-d392-402c-8f32-4d7466c21069/export {"uuid": "734641eb-d392-402c-8f32-4d7466c21069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/tiff.bunny.blue.ap.brid.gy/post/3mupuictwntq2", "content": "huh maybe mastodon's delayed migration from paperclip to activestorage saved us from CVE-2026-66066", "creation_timestamp": "2026-09-04T21:04:27.165382Z"} {"uuid": "734641eb-d392-402c-8f32-4d7466c21069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/tiff.bunny.blue.ap.brid.gy/post/3mupuictwntq2", "content": "huh maybe mastodon's delayed migration from paperclip to activestorage saved us from CVE-2026-66066", "creation_timestamp": "2026-09-04T21:04:27.165382Z"} https://vulnerability.circl.lu/sighting/734641eb-d392-402c-8f32-4d7466c21069/export Fri, 04 Sep 2026 21:04:27 +0000 https://vulnerability.circl.lu/sighting/c61736ac-e6f7-45e8-82e2-bd75c6543f6c/export {"uuid": "c61736ac-e6f7-45e8-82e2-bd75c6543f6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/48033", "content": "CVE-2026-66066 in Ruby on Rails\n*\nStorage file-read-to-RCE chain\n\n*\nPoC", "creation_timestamp": "2026-09-03T00:00:52.514524Z"} {"uuid": "c61736ac-e6f7-45e8-82e2-bd75c6543f6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/48033", "content": "CVE-2026-66066 in Ruby on Rails\n*\nStorage file-read-to-RCE chain\n\n*\nPoC", "creation_timestamp": "2026-09-03T00:00:52.514524Z"} https://vulnerability.circl.lu/sighting/c61736ac-e6f7-45e8-82e2-bd75c6543f6c/export Thu, 03 Sep 2026 00:00:52 +0000