ID:12875 - Exploit for Insecure Default Initialization of Resource in activestorage - CVE-2026-66066

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to disclose sensitive information and potentially execute arbitrary code.

The vulnerability exists due to initialization of a resource with an insecure default in Active Storage variant processing when processing a crafted uploaded file to generate an image variant. A remote attacker can upload a crafted file and cause a variant to be generated from it to disclose sensitive information and potentially execute arbitrary code.

Only applications using libvips for Active Storage image processing and allowing image uploads from untrusted users are vulnerable.

Remediation