CVE-2026-66066: Rails Active Storage variant processing arbitrary file read and potential RCE
CVE-2026-66066 is verified against rails/rails · github affected versions: activestorage < 7.2.3.2 (Rails 7.0.0-7.2.3.1 affected in default config); 8.0.0-8.0.5; 8.1.0-8.1.3; Rails 6.x only with non-default Active Storage config vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00317.
pruva-verify REPRO-2026-00317 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00317/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh GHSA-xr9x-r78c-5hrm / CVE-2026-66066. In Rails Active Storage, the default libvips-based variant processing path can allow an unauthenticated attacker who can upload crafted image content to cause arbitrary file reads from the server filesystem, including process environment secrets such as secret_key_base. Those secrets can then enable remote code execution or lateral movement. Affected configurations use config.active_storage.variant_processor = :vips and allow untrusted image uploads. Fixed versions are activestorage 7.2.3.2, 8.0.5.1, and 8.1.3.1. libvips >= 8.13 is required for secure blocking of untrusted operations; older libvips versions have no secure workaround other than removing the dependency on libvips.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.