Full Report
Rails security advisory (AV26-767)
Analysis Summary
# Vulnerability: Arbitrary File Read and RCE in Rails Active Storage
## CVE Details
- **CVE ID:** CVE-2026-66066
- **CVSS Score:** Not explicitly rated in the advisory, but typically categorized as **Critical** (9.0+) for this class of flaw.
- **CWE:** CWE-94 (Improper Control of Generation of Code), CWE-22 (Path Traversal)
## Affected Systems
- **Products:** Ruby on Rails (Active Storage component)
- **Versions:**
- Versions prior to 7.2.3.2
- Versions prior to 8.0.5.1
- Versions prior to 8.1.3.1
- **Configurations:** Systems utilizing **Active Storage** variant processing for image or file manipulation.
## Vulnerability Description
A vulnerability exists in the way Active Storage processes file "variants." Due to insufficient validation of parameters passed to the underlying transformation engine (such as ImageMagick or vips), an attacker can craft malicious requests to perform arbitrary file reads from the server. In certain configurations, this can be escalated to Remote Code Execution (RCE) by leveraging the processing engine to execute arbitrary commands.
## Exploitation
- **Status:** Vulnerability disclosed; PoC status not explicitly confirmed in this advisory but technically feasible based on description.
- **Complexity:** Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Ability to read sensitive system files)
- **Integrity:** High (Potential for unauthorized modification via RCE)
- **Availability:** High (Potential for system takeover or service disruption)
## Remediation
### Patches
Users are urged to upgrade to the following versions:
- **Rails 7.2.3.2**
- **Rails 8.0.5.1**
- **Rails 8.1.3.1**
### Workarounds
No specific configuration workarounds were provided in the advisory. Upgrading the Rails gem is the recommended course of action. If immediate upgrading is impossible, consider disabling Active Storage variant processing or restricting access to variant generation endpoints.
## Detection
- **Indicators of Compromise:** Unusual file access patterns in application logs; unexpected outbound network connections from the web server; presence of shell commands in parameters related to Active Storage transformations.
- **Detection methods and tools:** Audit application logs for requests to `/rails/active_storage/representations/redirect/` that contain suspicious or non-standard transformation parameters.
## References
- [Official Ruby on Rails Discussion] - hxxps[://]discuss[.]rubyonrails[.]org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432
- [GitHub Release 7.2.3.2] - hxxps[://]github[.]com/rails/rails/releases/tag/v7.2.3.2
- [GitHub Release 8.0.5.1] - hxxps[://]github[.]com/rails/rails/releases/tag/v8.0.5.1
- [GitHub Release 8.1.3.1] - hxxps[://]github[.]com/rails/rails/releases/tag/v8.1.3.1
- [Cyber Centre Advisory] - hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/rails-security-advisory-av26-767