A new Metasploit Framework module has been submitted for review, targeting the critical Ruby on Rails Active Storage vulnerability, tracked as CVE-2026-66066.
This submission poses an increased risk to applications that utilize the Vips image-processing backend. The proposed module is named `exploit/multi/http/rails_activestorage_vips_rce` and was introduced in Rapid7 Metasploit Framework pull request #21733 by contributor jburgess-r7. As of now, the pull request remains open and has not been merged into the main Metasploit Framework branch.
CVE-2026-66066, also known as GHSA-xr9x-r78c-5hrm, affects Rails deployments that use Active Storage with the Vips variant processor. The issue arises from an untrusted loader condition involving Active Storage and libvips.
If successfully exploited, this vulnerability allows attackers to escalate from unauthorized file disclosure to remote code execution by manipulating crafted image-processing requests and Rails-signed variation data.
The proposed Metasploit module implements an attack chain based on research from security experts. It can utilize a valid Active Storage variation key or a full representation URL to obtain a target application.
From there, the module attempts to recover content accessible to the application, including Rails signing materials. It derives the verifier key used to create a maliciously signed image-processing variation. This forged variation can then trigger command execution through native ImageProcessing primitives.
Rapid7’s submission indicates that the module supports various Rails signing and serialization configurations, including SHA-1, SHA-256, SHA-384, and SHA-512 key-generation combinations.
It also accommodates different signed-message formats such as JSON, Marshal, and MessagePack, increasing compatibility across potentially affected Rails versions and deployment configurations. The module supports both modern redirect-based representation routes and legacy Rails 6 representation routes.
The exploit has been tested in controlled environments with Rails versions 6.0.6.1, 6.1.7.10, and 8.0.5, all configured with Active Storage, image_processing, ruby-vips, and libvips builds that include MAT/HDF5 support. The author reported successful command-shell access under the Rails process account during testing.
Validation included an updated Rails version 8.0.5.1 instance, in which the previously documented arbitrary file-read behavior was not reproduced under the tested conditions.
The pull request includes 11 changed files and over 3,100 lines of additions, including the exploit module, documentation, test specifications, and supporting MAT/HDF5 artifacts. Static analysis, documentation checks, RuboCop validation, and a dedicated test suite reportedly completed without any failures.
The author noted the use of AI-assisted tools during development and review, while asserting that the exploit’s behavior and lab validation were manually verified.
Organizations running Ruby on Rails applications should immediately determine whether Active Storage is configured to use the Vips variant processor and review the affected version ranges referenced in the advisory.
Administrators should apply vendor-provided security updates, rotate SECRET_KEY_BASE values if there is any suspicion of exposure, monitor image-processing and representation endpoints for unusual requests, and investigate any unexpected activity by Rails workers.
Since public Metasploit support may make exploitation easier once merged, patching vulnerable deployments should be treated as a top priority.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
