SB2026080390 - Remote code execution in Ruby ActiveStorage

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080390

SB2026080390 - Remote code execution in Ruby ActiveStorage

Published: August 3, 2026

Security Bulletin ID SB2026080390
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-66066)

CWE-ID: CWE-1188 - Insecure Default Initialization of Resource

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and potentially execute arbitrary code.

The vulnerability exists due to initialization of a resource with an insecure default in Active Storage variant processing when processing a crafted uploaded file to generate an image variant. A remote attacker can upload a crafted file and cause a variant to be generated from it to disclose sensitive information and potentially execute arbitrary code.

Only applications using libvips for Active Storage image processing and allowing image uploads from untrusted users are vulnerable.


Remediation

Install update from vendor's website.

References