Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-29 18:10 UTC
Importiert: 2026-08-05 13:51 UTC
CVSS: 9.5
Quelle-ID: thn_global
uid_hash: e775a793942887acbe61890a38492f8dfa40fdfa3a213a0bb75e6e076004aea9

The Hacker News

Inhalt

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.

Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-66066	CRITICAL	9.5	CRITICAL	9.5			2026-07-30

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste