exploit/multi/http/rails_activestorage_vips_rce
functionalRuby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution
01
exploited CVEs (2)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-66066US | —OT elevated | Exploit | ||
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked… | ||||
| CVE-2025-24293US | — | Exploit | ||
# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of potentially unsafe image
transformation methods and parameters… | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan