Ruby on Rails Active Storage - Remote Code Execution CVE-2026-66066
- Severity
- EPSS Score
- EPSS Percentile
- Vulnerability description
- Not available
- Risk description
- Not available
- Exploit capabilities
Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.
- Recommendation
- Not available
- References
- https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrmhttps://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432https://www.openwall.com/lists/oss-security/2026/07/29/9https://advisories.gitlab.com/gem/activestorage/CVE-2026-66066/
- Codename
- KindaRails2Shell
- Detectable with
- Network Scanner
- Scan engine
- Sniper
- Cisa Kev
- No
- Exploitable with Sniper
- Yes
- CVE Published
- Jul 29, 2026
- Detection added at
- Software Type
- Shared library
- Vendor
- Rails
- Product
- Active Storage
Detect this vulnerability now!
Check your clients' targets (or your own) for this vulnerability and thousands more! Get proof for validation with our ethical hacking toolkit.