CVE-2026-66066

Think of Active Storage like your app’s “photo editor pipeline.” This issue means a specially made photo might trick the editor into touching files it shouldn’t. If the attacker can read secrets (like app keys), they may use those secrets to take over the app or move deeper into your systems.

This matters if you run a Rails app that accepts image uploads from untrusted users and processes those uploads through Active Storage variant processing using libvips. If your app doesn’t use that image-processing path, exposure is less likely. Also, the danger is only relevant when an attacker can reach the upload feature (i.e., the upload endpoint is reachable from the internet and the app accepts user-controlled images).

This is RED because exploitation has been tied to active malicious activity (Laundry Bear), and the issue directly involves a public-facing capability: malicious image uploads being processed by your app. Even with no public exploit code on record, the combination of real-world actor attention and the ability to read sensitive files makes it a priority to address now.

Confirm exposure (what to check)

• Determine whether you use Rails Active Storage for handling uploads (especially images) and whether you generate variants (e.g., resizing/cropping) using the libvips path.
• Identify your exact Rails version from your deployment/build (Gemfile.lock or equivalent).
• Confirm whether uploads come from untrusted users (customers/public) and whether the upload endpoint is reachable from the internet.

Find the upgrade path

• The provided findings state no fix/patch information was available, so you should not guess a version.
• Escalate to your Rails/hosting vendor or internal maintainers and provide:
  • CVE: CVE-2026-66066
  • Your Rails version
  • Whether you use Active Storage variants and libvips
  • Your hosting environment details (container/VM, deployment method)
• Ask specifically for an approved remediation for your branch (upgrade target or hotfix) and confirmation that it disables unsafe libvips operations for untrusted content.

Temporary workaround (if patch timing is uncertain)

• If you can’t confirm a safe patched version quickly, reduce risk by:
  • Temporarily restricting uploads of images from untrusted users, or
  • Limiting/turning off features that generate Active Storage variants for untrusted uploads.
• If you must keep uploads enabled, implement compensating controls via your platform/edge (rate limits, file-type validation, size limits) while you complete the upgrade.

Monitoring after changes

• After applying mitigation/upgrade:
  • Watch for repeated failures/timeouts/errors in image processing flows.
  • Review logs around upload and variant generation endpoints for abnormal patterns.
  • Confirm that no sensitive file access attempts are indicated (if you have file-access logging, enable it temporarily).

CISA due date

• No CISA KEV listing was provided in the findings, so no KEV-driven due date can be stated here.

CVE-2026-66066 is categorized under CWE-1188 and targets Rails Active Storage variant processing (Action Pack component). The described mechanism is unsafe handling during image processing: Active Storage does not disable libvips operations marked unsafe for untrusted content, so a crafted upload can trigger behavior that enables arbitrary file read from what the Rails process can access. If sensitive credentials (e.g., application secret material) are exposed through file read, that can enable escalation to remote code execution or lateral movement, depending on the application’s architecture.

Verdict context from provided findings: no public exploit code was recorded, KEV is not listed, and a prediction (EPSS) was supplied with a rising trend; however, a separate finding indicates sustained press attention tied to exploitation by Laundry Bear, which is why urgency is treated as high. The provided findings also state that no patch/upgrade guidance was available, so remediation steps must be confirmed for the specific Rails version and configuration in your environment.