{"id":"CVE-2026-66066","kind":"vulnerability","aliases":["CVE-2026-66066"],"related":[],"title":"Rails: Active Storage image variants let unauthenticated requests read files, run code","description":"WAF Release - 2026-08-04 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 4, 2026\n\n## WAF Release - 2026-08-04\n\nThis release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.\n\nKey Findings\n\n- CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.\n- CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and achieve Remote Code Execution (RCE) using maliciously crafted payload requests.\n- Generic Cloud Protections: Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...052b07cf | N/A | Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066 | Block | Block | This was labeled as File Upload - RCE. |\n| Cloudflare Managed Ruleset | ...743a63ec | N/A | SSRF - Local - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...ab8af26f | N/A | SSRF - Cloud - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...25ba9d7c | N/A | SSRF - Cloud | Disabled | Block | We are changing the action for this rule from Disabled to BLOCK |\n| Cloudflare Managed Ruleset | ...01a076eb | N/A | SSRF - Local - Beta | Disabled | - | This detection has been removed. |","summary":"Ruby on Rails Active Storage mishandles input in image variant transformations, so a crafted request can be processed unsafely. According to Cloudflare, an unauthenticated attacker can read arbitrary files and achieve remote code execution.","severity":"critical","cvss":9.5,"epss":0.27861,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activestorage","cloudflare","lab-disclosure","rails","ruby","runtime","self-hosted"],"not_affected_if":["no-active-storage-variants"],"how_to_check":"- Check the Rails version in `Gemfile.lock` for the `actionpack` and `activestorage` gems; the sources do not name the fixed versions, so compare against the vendor advisory.\n- Check whether the app uses Active Storage image variants (`variant` or `variant_with` calls, or `config.active_storage` settings).","fix":"- Upgrade Rails and Active Storage to a patched release: unknown, the sources do not give the version.\n- Cloudflare customers: the managed rule 'Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066' is set to Block as of 2026-08-04, which reduces exposure but is not a code fix.","status":"open","published_at":"2026-07-30T19:18:35+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T05:29:16+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:29:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Rails and Active Storage to a patched release: unknown, the sources do not give the version.\n- Cloudflare customers: the managed rule 'Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066' is set to Block as of 2026-08-04, which reduces exposure but is not a code fix.","reach":"internet","title":"Rails: Active Storage image variants let unauthenticated requests read files, run code","impact":"high","summary":"Ruby on Rails Active Storage mishandles input in image variant transformations, so a crafted request can be processed unsafely. According to Cloudflare, an unauthenticated attacker can read arbitrary files and achieve remote code execution.","category":"runtime","nicknames":[],"who_cares":["rails","ruby","self-hosted","activestorage"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads arbitrary files and runs code on the server","analyst_note":"Find the NVD or Rails vendor advisory for CVE-2026-66066 to get affected and fixed Rails versions, and confirm the exposed Active Storage configuration.","how_to_check":"- Check the Rails version in `Gemfile.lock` for the `actionpack` and `activestorage` gems; the sources do not name the fixed versions, so compare against the vendor advisory.\n- Check whether the app uses Active Storage image variants (`variant` or `variant_with` calls, or `config.active_storage` settings).","needs_analyst":true,"not_affected_if":["no-active-storage-variants"],"who_is_affected":"Applications running Ruby on Rails with Active Storage that process image variants on user-supplied requests are the likely exposure. The sources do not say which Rails versions are affected, so teams should check their Rails version against the vendor advisory. Apps without Active Storage variant processing are probably not exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001117,"input_tokens":4155,"output_tokens":1403,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-04':68C,84C '-08':67C,83C '-2026':14A,17A,105C,129C,210C,231C '-50522':106C,211C '-66066':15A,18A,130C,232C '01a076eb':310C '052b07cf':201C '2':249C,278C '2026':66C,79C,82C '25ba9d7c':289C '3a5b40d6':222C '4':78C '743a63ec':245C 'ab8af26f':274C 'accord':49B 'achiev':60B,157C 'action':101C,194C,196C,299C 'activ':2A,33B,140C 'activestorag':19B 'add':170C 'allow':117C,147C 'alongsid':95C 'applic':185C 'arbitrari':57B,123C,153C,225C 'attack':54B,120C,150C 'august':77C 'beta':250C,264C,279C,314C 'block':213C,233C,234C,294C,306C 'c2e84e2d':260C 'chang':297C 'changelog':69C,70C 'cloud':98C,168C,183C,263C,277C,292C 'cloud-host':182C 'cloudflar':20B,51B,76C,198C,219C,242C,257C,271C,286C,307C 'code':12A,62B,124C,159C,206C 'comment':197C 'craft':43B,126C,164C 'cve':13A,16A,104C,128C,208C,209C,229C,230C 'descript':192C 'deseri':109C 'detect':172C,218C,253C,267C,282C,317C 'disabl':251C,265C,280C,293C,304C,315C 'disclosur':23B 'enhanc':96C 'execut':63B,122C,160C,207C 'file':10A,58B,154C,226C,239C 'find':103C 'forgeri':179C 'generic':167C 'host':29B,184C 'id':188C,191C 'imag':4A,38B,142C 'improp':132C 'improv':74C,171C 'input':36B,133C 'insecur':108C 'introduc':87C 'key':102C 'lab':22B 'lab-disclosur':21B 'label':237C 'legaci':189C 'let':6A 'local':248C,313C 'log':212C 'logic':173C 'malici':163C 'manag':199C,220C,243C,258C,272C,287C,308C 'may':116C,146C 'microsoft':92C,112C,203C 'mishandl':35B 'n/a':202C,223C,246C,261C,275C,290C,311C 'new':71C,88C,195C,217C 'payload':165C 'perform':152C 'previous':193C 'process':47B,134C 'protect':99C,169C 'rail':1A,24B,32B,139C,224C 'rce':94C,161C,228C,241C 'read':9A,56B,155C,227C 'releas':65C,81C,86C 'remot':61B,158C,205C 'remov':256C,270C,285C,320C 'request':8A,44B,127C,166C,178C 'rubi':25B,30B,137C 'rule':89C,100C,187C,190C,302C 'ruleset':186C,200C,221C,244C,259C,273C,288C,309C 'run':11A 'runtim':26B 'self':28B 'self-host':27B 'server':114C,176C 'server-sid':175C 'sharepoint':93C,113C,204C 'side':177C 'ssrf':97C,180C,247C,262C,276C,291C,312C 'storag':3A,34B,141C 'target':174C 'transform':40B,144C 'unauthent':7A,53B,119C,149C 'unsaf':48B 'updat':72C,91C 'upload':240C 'use':125C,162C 'variant':5A,39B,143C 'vulner':110C,135C 'waf':64C,80C","nicknames":[],"mitigations":[],"who_affected":"Applications running Ruby on Rails with Active Storage that process image variants on user-supplied requests are the likely exposure. The sources do not say which Rails versions are affected, so teams should check their Rails version against the vendor advisory. Apps without Active Storage variant processing are probably not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-30T19:18:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/#CVE-2026-66066","url":"https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/","severity":null,"published_at":"2026-08-04T18:42:13+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Cloudflare: WAF Release - 2026-08-04 · Changelog"},{"source":"nvd","external_id":"CVE-2026-66066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66066","severity":null,"published_at":"2026-07-30T19:18:35+00:00","modified_at":"2026-09-10T20:36:14+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null},{"source":"epss","external_id":"CVE-2026-66066","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-66066","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2874,"url":"https://developers.cloudflare.com/changelog/post/2026-08-04-waf-release/","title":"Cloudflare: WAF Release - 2026-08-04 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-08-04 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 4, 2026\n\n## WAF Release - 2026-08-04\n\nThis release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.\n\nKey Findings\n\n- CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.\n- CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and achieve Remote Code Execution (RCE) using maliciously crafted payload requests.\n- Generic Cloud Protections: Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...052b07cf | N/A | Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066 | Block | Block | This was labeled as File Upload - RCE. |\n| Cloudflare Managed Ruleset | ...743a63ec | N/A | SSRF - Local - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...ab8af26f | N/A | SSRF - Cloud - 2 - Beta | Disabled | - | This detection has been removed. |\n| Cloudflare Managed Ruleset | ...25ba9d7c | N/A | SSRF - Cloud | Disabled | Block | We are changing the action for this rule from Disabled to BLOCK |\n| Cloudflare Managed Ruleset | ...01a076eb | N/A | SSRF - Local - Beta | Disabled | - | This detection has been removed. |","published_at":"2026-08-04T18:42:13+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}