CVE-2026-66066

This repository provides a functional proof-of-concept for CVE-2026-66066, a Rails Active Storage file-read-to-RCE chain exploiting unsafe deserialization in libvips image processing. The exploit constructs a malicious HDF5/MATLAB external-storage image with an embedded Ruby Marshal payload to leak SECRET_KEY_BASE and achieve remote code execution via MiniMagick::Tool.

This repository contains forensic tools to detect and analyze exploitation of CVE-2026-66066, a vulnerability in Ruby on Rails' Active Storage component involving libvips and libmatio. The tools scan for crafted MAT files that exploit an external file read issue in HDF5 containers, but do not contain exploit code.

This repository contains a configuration audit script for CVE-2026-66066, a vulnerability in Ruby on Rails' Active Storage component when using libvips as the variant processor. The script collects evidence to determine if a Rails application is exposed to arbitrary file read and remote code execution via unsafe libvips operations, but does not exploit the vulnerability.

This repository provides a high-level overview of CVE-2026-66066, a pre-authentication RCE vulnerability in Ruby on Rails Active Storage when processing images with libvips. However, it lacks exploit code, technical depth, or proof-of-concept details, serving only as a placeholder for documentation and detection rules.