CVE-2026-66066 Active Storage Vips templates

This directory contains the generator for the HDF5/MATLAB external-storage templates used by modules/exploits/multi/http/rails_activestorage_vips_rce.rb. The generated artifacts are committed under data/exploits/CVE-2026-66066/.

Build

The generator requires Python 3, NumPy, and h5py. The committed artifacts were generated with the following reference toolchain on x86-64 Linux:

CPython 3.13.5
pip 25.1.1
NumPy 2.5.1
h5py 3.16.0 (the manylinux wheel bundles HDF5 2.0.0)

Use the pinned versions when byte-for-byte reproducibility is required. HDF5 metadata serialization can differ between library releases even when the resulting dataset is semantically equivalent.

python3.13 -m venv .venv
.venv/bin/python -m pip install 'pip==25.1.1'
.venv/bin/python -m pip install --only-binary=:all: 'numpy==2.5.1' 'h5py==3.16.0'
.venv/bin/python external/source/exploits/CVE-2026-66066/generate_msf_templates.py

Run the commands from the Metasploit Framework root. The script performs local layout checks while generating each template and writes the resulting files to data/exploits/CVE-2026-66066/.

The expected SHA-256 digests for the reference toolchain are:

text

c24104e665036dfe84f5ad616368c4b2f5b0c8180ae0ac7aa5606cc0b0d36236  ascii_256.mat
24b14bd0015c5a1370a1395119f44cd9e2a48e99747a510fefda95be461dbf40  ascii_100.mat
f4512b49ee9d781857b60f49311c08cfd395794d01aa48f585c141afff3e2042  ascii_64.mat
0aad1429cb605e09fc640c0da51188213d0ec457783837ab3d86eb4de01ab047  ascii_32.mat
5dbf7909fbfa954fec333c8ad7bd63845a224d95d7a617339996f710c8da1068  ascii_20.mat
c953962ddd38cadbe167955010d4d228868d9f31a43f75c48250b37dd6c14fa8  ascii_16.mat

MATLAB class attribute compatibility

The MATLAB_class attribute deliberately uses a fixed-width S6 value containing uint8 followed by an explicit NUL byte. Do not shorten it to S5 or replace it with a variable-length string.

libmatio 1.5.24 and earlier read this attribute into a same-width, NUL-terminated memory type. An S5 value has no room for the terminator, so those releases truncate uint8 to uint and reject the dataset with unsupported class type 0. Storing uint8\0 as S6 works with those older libmatio releases as well as newer releases and keeps the templates usable on common supported distributions.