Re: Rails CVE-2026-66066: Possible arbitrary file read and remote code execution in Active Storage variant processing

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 7/29/2026 3:46 PM, Alan Coopersmith wrote:
> https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
> advises:
> > Possible arbitrary file read and remote code execution in Active Storage
> >  variant processing
> >
> > Critical
> >
> > byroot published GHSA-xr9x-r78c-5hrm 29 July 2026
[...]
> > Disclosure
> > ----------
> >
> > Technical details of the attack chain are intentionally omitted from this
> > advisory. They would add nothing to an administrator's decision to 
> > upgrade,
> > while making it substantially easier to attack applications that have 
> > not yet
> > done so.
> >
> > Details will be disclosed no later than 2026-08-28, via the Rails 
> > Security
> > Announcements forum:
> > https://discuss.rubyonrails.org/c/security-announcements/9

That further disclosure has happened now, announced at:
https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441

> We originally intended to publish these details no later than
> 2026-08-28, but several researchers quickly reverse-engineered the
> attack and have already published proofs-of-concept. As a result, we are
> disclosing details about the attack now, along with some tools to help
> assess whether an application was vulnerable and to help examine the
> forensic evidence for signs of secret exfiltration.
>
> We have published all of this in a git repository,
> <https://github.com/rails/rails-forensics-CVE-2026-66066>, 
> which contains:
>
>  * reference/the-attack.md explains how the attack works, step by step,
>    from the incoming request to the file being read.
>  * reference/the-investigation.md explains what evidence the attack
>    leaves behind in your database and your object store, and what that
>    evidence does and does not prove.
>  * The kr2s-was-i-vulnerable agent skill works out whether your
>    application was ever vulnerable, and if it was, over what period of
>    time.
>  * The kr2s-was-i-exploited agent skill searches your Active Storage
>    data for the crafted files, and works out what was read if it finds
>    any.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris