CVE-2026-66066
CriticalAdvisory
Published 30 Jul 2026In the index since 6 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.5
- base score, highest
- EPSS
- 0.279
- 98th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 25
- of 17,781 indexed, latest versions
- Container images
- 23
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 23 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| activestoragegem | 5.2.4.6, 6.0.3.1, 6.0.3.4, 6.1.4.1+12 more | 7.2.3.2, 8.0.5.1, 8.1.3.1 | 23 |
- OSV records
- GHSA-xr9x-r78c-5hrm
Charts affected
25 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| chatwootchatwootVerified publisher | 2.0.24 | 1 of 3See more | 9,203 |
| uffizzi-appuffizzi-app | 1.3.0 | 1 of 14See more | 19,337 |
| huginnutkuozdemirVerified publisher | 2.2.1 | 1 of 4See more | 18,137 |
| mastodondefault-ghVerified publisher | 0.3.1 | 1 of 3See more | 5,056 |
| zammaddevplayer0Verified publisher | 4.0.5 | 1 of 4See more | 6,110 |
| docker-registry-browsergmelilloVerified publisher | 0.1.2 | 1 of 1See more | 4,108 |
| openprojecthomeenterpriseinc | 0.5.0 | 1 of 1See more | 6,810 |
| chatwootmaxcrm-chartsVerified publisher | 1.1.201 | 1 of 4See more | 5,940 |
| redminemt190502 | 7.3.4 | 1 of 3See more | 7,527 |
| redmineredmine-helm-chartVerified publisher | 0.2.6 | 1 of 1See more | 4,240 |
| antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher | 0.2.0 | 1 of 1See more | 2,766 |
| caninecanine | 0.1.10 | 1 of 7See more | 14,130 |
| docker-registry-browsergtaylor | 0.4.4 | 1 of 1See more | 3,564 |
| octoboxhalkeye | 0.1.1 | 1 of 1See more | 3,255 |
| manyfoldjeffrescVerified publisher | 1.0.3 | 1 of 1See more | 1,960 |
| deltabadgerk8s-chartsVerified publisher | 2.0.0 | 1 of 1See more | 5,669 |
| gitlabkubesphereVerified publisher | 4.2.3 | 3 of 17See more | 38,133 |
| maxcrm-chartsmaxcrm-chartsVerified publisher | 1.1.201 | 1 of 4See more | 5,940 |
| danboorumy0nVerified publisher | 0.0.2 | 1 of 1See more | 12,791 |
| danbooru-stackmy0nVerified publisher | 0.0.3 | 1 of 4See more | 12,791 |
| betydbncsaVerified publisher | 0.6.1 | 1 of 4See more | 9,542 |
| pecanncsaVerified publisher | 0.6.2 | 1 of 15See more | 14,154 |
| redminerestic-pvc-backupVerified publisher | 0.2.6 | 1 of 1See more | 4,240 |
| mastodonrivals-spaceVerified publisher | 3.1.2 | 1 of 3See more | 6,026 |
| maybe-financevicsuferVerified publisher | 0.2.7 | 1 of 3See more | 10,795 |
Container images carrying it
23 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| chatwoot/ | d530ab8c1753 | activestorage | 7.2.3.2 | 2 |
| library/ | f474a901faec | activestorage | 7.2.3.2 | 2 |
| pecan/ | f825d480cd62 | activestorage | 7.2.3.2 | 2 |
| ghcr.io/ | 5f545698e907 | activestorage | 7.2.3.2 | 2 |
| chatwoot/ | 67ebc751c171 | activestorage | 7.2.3.2 | 1 |
| docuseal/ | 7493fd7f6728 | activestorage | 8.1.3.1 | 1 |
| huginn/ | c794eddc7b47 | activestorage | 7.2.3.2 | 1 |
| klausmeyer/ | 430a440d95af | activestorage | 7.2.3.2 | 1 |
| klausmeyer/ | bdc4c6b8595b | activestorage | 7.2.3.2 | 1 |
| library/ | 04ac44a2595b | activestorage | 7.2.3.2 | 1 |
| mirrorgitlabcontainers/ | 94d1431683fa | activestorage | 7.2.3.2 | 1 |
| mirrorgitlabcontainers/ | 9efd73993c34 | activestorage | 7.2.3.2 | 1 |
| mirrorgitlabcontainers/ | 30393f990f5c | activestorage | 7.2.3.2 | 1 |
| octoboxio/ | d909041c46eb | activestorage | 8.1.3.1 | 1 |
| openproject/ | 734743d11094 | activestorage | 7.2.3.2 | 1 |
| uffizzi/ | 66e9e3937c60 | activestorage | 7.2.3.2 | 1 |
| zammad/ | 2808e2dfa810 | activestorage | 7.2.3.2 | 1 |
| ghcr.io/ | a058034ca006 | activestorage | 7.2.3.2 | 1 |
| ghcr.io/ | bffe3c22fabc | activestorage | 8.1.3.1 | 1 |
| ghcr.io/ | d14ca4d82475 | activestorage | 8.0.5.1 | 1 |
| ghcr.io/ | 6b18e6d0eda4 | activestorage | 7.2.3.2 | 1 |
| ghcr.io/ | c6ab95ca9130 | activestorage | 7.2.3.2 | 1 |
| ghcr.io/ | 43b23d55e4be | activestorage | 7.2.3.2 | 1 |