A newly disclosed vulnerability in Ruby on Rails' Active Storage component has garnered significant attention among cybersecurity experts following researchers showcasing a complete chain of exploitation starting with server secret exposure and concluding with remote code execution. Identified as CVE-2026-66066 (GHSA-xr9x-r78c-5hrm), this flaw impacts versions of Active Storage prior to 7.2.3.2, along with vulnerable Rails 8.0 and 8.1 releases when applications utilize the Vips variant processor for image handling. Jburgess highlighted that a highly effective exploit is its resize-tolerant exfiltration method, which utilizes multiple square HDF5 layouts alongside Vips sharpen inversion to reliably extract data irrespective of how the target application resizes images.
In a validated lab test against Rails 8.0.5 and Rails 6.0.6.1 targets, the exploit successfully retrieved the SECRET_KEY_BASE from process environment variables, derived the correct verifier key, and opened command shell sessions running as the Rails process user. The developer highlighted that the representation-based PNG transport method employed in the released module offers larger, more reliable reads suitable for automated secret recovery, making it superior for practical exploitation compared to narrower metadata-based channels. The module's demonstrated reliability across various Rails versions and support for reverse shell payloads including cmd/unix/reverse_bash and Meterpreter indicate it is a critical, actively exploitable risk that must be treated seriously rather than considered theoretical.
