External risk intelligence

Action Pack Unsafe Libvips Operation Allows Arbitrary File Read

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-66066

The vulnerability exists in a web request handling framework that processes user-uploaded content. Because this is a core component of web applications commonly deployed as internet-facing services to accept user data, it is likely to be reachable from the internet in standard deployments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Action Pack framework, affecting how web requests are handled. This issue could allow unauthorized access to sensitive information if the application uses specific image processing libraries and accepts uploads from untrusted sources. The potential exposure of credentials could lead to further compromise of systems.

Unsafe image uploads can expose secrets.
Affects core web request handling.
Assess relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by uploading a specially crafted image file to a web application. This file would leverage the Action Pack framework's handling of web requests and its use of the libvips image processing library. When processing this malicious upload, the framework may invoke unsafe libvips operations, leading to the exposure of sensitive files.

Requires an attacker to upload a crafted file.
Triggers when the application processes untrusted image uploads.
Risk of exposing credentials and enabling further compromise.

Live Threat

Current exploitation, exposure, and threat context

When configured to use libvips and accept image uploads from untrusted users, a Rails application could allow an unauthenticated attacker to read arbitrary files accessible to the Rails process. This could include sensitive information like environment variables and application secrets.

Server files and application secrets at risk.
Crafted image uploads could trigger unsafe operations.
Exposure may enable code execution or lateral movement.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Platform Engineering or Application Development teams are likely responsible for Action Pack, as it's a framework for handling web requests. The first practical step is to identify all deployments, confirm their reachability and business criticality, and then assign an owner for remediation planning.

Platform or App Dev owns the issue.
Verify if libvips is enabled and accepting uploads.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Action Pack framework in Ruby on Rails?

Action Pack is a core component of the Ruby on Rails framework responsible for web request handling. It manages how applications receive incoming HTTP requests, process data, and send responses back to the user. Active Storage, a library often used alongside it for file uploads, integrates with this framework to handle image processing tasks using external tools like libvips.

What is the weakness class behind CVE-2026-66066?

This vulnerability is categorized as CWE-1188, which involves the use of insecure default components. In this specific case, the flaw allows the software to execute unsafe operations within the libvips library when processing image files. Because the framework does not adequately restrict these operations, it treats malicious, crafted uploads as legitimate requests, enabling the software to interact with system files it should not access.

Does any image upload trigger this flaw?

No. The vulnerability only triggers if the application is specifically configured to use libvips for image processing and accepts uploads from untrusted sources. Applications that do not use libvips or that strictly restrict image uploads to authorized, internal sources are not impacted by this specific attack path.

Why does Halo Surface Signal flag this as likely relevant?

Halo Surface Signal identifies this as likely relevant because Action Pack is a foundational framework for many public-facing web applications. Since these services are often deployed to accept user-submitted content, the attack surface is significant. If your Rails application is internet-facing and handles image uploads, it is a prime target for attackers seeking to reach internal files or sensitive environment variables.

How do I respond to CVE-2026-66066?

Your first step is to check if your Rails application uses libvips for image processing and accepts user uploads. If it does, consult your platform or development team to prioritize updating to the patched versions: 7.2.3.2, 8.0.5.1, or 8.1.3.1. These updates contain the necessary changes to disable the unsafe libvips operations and secure your application against unauthorized file reads.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.