Timeline for Active Storage gem update (CVE-2026-66066) in self-managed GitLab
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
Hi GitLab team,
We're running self-managed GitLab [CE and EE] version 19.2.1 and our dependency scanner is flagging activestorage 7.2.3.1 as vulnerable to CVE-2026-66066 (critical arbitrary file read / potential RCE in Active Storage variant processing via libvips). Upstream Rails fixed this in activestorage 7.2.3.2 on July 29, 2026, but GitLab's 19.2.1 patch release (shipped the same day) did not include this bump.
We'd appreciate clarification on two points:
Is there a timeline for GitLab bumping activestorage to 7.2.3.2 (or later) in an upcoming patch release? Separately — based on GitLab's own file storage documentation, it appears GitLab's actual upload pipeline uses CarrierWave rather than Active Storage's has_one_attached/has_many_attached model API, which is a precondition for this CVE's exploit chain. Can GitLab confirm whether this CVE is actually reachable/exploitable in a standard GitLab deployment, or whether the activestorage gem is present only as an unused bundled Rails dependency?
This would help us assess whether to treat this as an active risk or a scanner false positive while we wait for the version bump.
Instance details: [GitLab version, 19.2.1-ee and ce], [Docker], [self-managed]
Thanks,