Live › vulnerability › CVE-2026-66066
Go to dashboardRuby on Rails Active Storage mishandles input in image variant transformations, so a crafted request can be processed unsafely. According to Cloudflare, an unauthenticated attacker can read arbitrary files and achieve remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.
Applications running Ruby on Rails with Active Storage that process image variants on user-supplied requests are the likely exposure. The sources do not say which Rails versions are affected, so teams should check their Rails version against the vendor advisory. Apps without Active Storage variant processing are probably not exposed, but the sources do not confirm this.
No product ranges from the sources yet.
Gemfile.lock for the actionpack and activestorage gems; the sources do not name the fixed versions, so compare against the vendor advisory.variant or variant_with calls, or config.active_storage settings).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-08-04 · Changelog
New updates and improvements at Cloudflare.
August 4, 2026
This release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...052b07cf | N/A | Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066 | Block | Block | This was labeled as File Upload - RCE. |
| Cloudflare Managed Ruleset | ...743a63ec | N/A | SSRF - Local - 2 - Beta | Disabled | - | This detection has been removed. |
| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Disabled | - | This detection has been removed. |
| Cloudflare Managed Ruleset | ...ab8af26f | N/A | SSRF - Cloud - 2 - Beta | Disabled | - | This detection has been removed. |
| Cloudflare Managed Ruleset | ...25ba9d7c | N/A | SSRF - Cloud | Disabled | Block | We are changing the action for this rule from Disabled to BLOCK |
| Cloudflare Managed Ruleset | ...01a076eb | N/A | SSRF - Local - Beta | Disabled | - | This detection has been removed. |
This page as .md · .json · in your agent: get_signal("CVE-2026-66066")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.