[CVE-2026-66066] Attack details, and tools to perform a forensic investigation

Security Announcements
1

Hello there, I’m writing as a member of the Rails security team about CVE-2026-66066.

As mentioned in the advisory, GHSA-xr9x-r78c-5hrm, we held back details about the attack vector to allow applications to be upgraded before malicious attackers could take advantage of the vulnerability.

We originally intended to publish these details no later than 2026-08-28, but several researchers quickly reverse-engineered the attack and have already published proofs-of-concept. As a result, we are disclosing details about the attack now, along with some tools to help assess whether an application was vulnerable and to help examine the forensic evidence for signs of secret exfiltration.

We have published all of this in a git repository, rails/rails-forensics-CVE-2026-66066, which contains:

  • reference/the-attack.md explains how the attack works, step by step, from the incoming request to the file being read.
  • reference/the-investigation.md explains what evidence the attack leaves behind in your database and your object store, and what that evidence does and does not prove.
  • The kr2s-was-i-vulnerable agent skill works out whether your application was ever vulnerable, and if it was, over what period of time.
  • The kr2s-was-i-exploited agent skill searches your Active Storage data for the crafted files, and works out what was read if it finds any.

I sincerely hope you find this information and these tools helpful. They were extracted from work I did at 37signals to perform a forensic analysis on our own apps. And if you have suggestions on how to improve it, I would welcome pull requests that are likely to be generally useful.

We again want to thank the original reporters, 0xacb, s3np41k1r1t0 and castilho of Ethiack, and RyotaK of GMO Flatt Security Inc., for responsibly reporting this vulnerability and for holding off on publishing attack details at our request.