{"uuid": "36d731fd-24d8-4fd4-9b28-fe615cc44395", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/0xacb.com/post/3mskvogj6is2a", "content": "libvips has flagged matload as untrusted for years and exposes a switch to block it. Rails\u2019 ActiveStorage just never flipped it. Until last week.\n\nThat\u2019s CVE-2026-66066: a .mat file declared as image/png, arbitrary file read, then RCE.\n\nFull chain\ud83d\udc47\n\nethiack.com/info-hub/res...", "creation_timestamp": "2026-08-08T10:51:55.854308Z"}