{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /rails/active_storage/direct_uploads, PUT /rails/active_storage/disk/:token, GET /rails/active_storage/representations/redirect/:signed_blob_id/:variation_key/:filename (Active Storage :vips variant processing)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "rails/activestorage 8.0.5 (vulnerable) and 8.0.5.1 (fixed) on puma",
    "ruby-vips",
    "libvips + matio + HDF5",
    "sqlite3"
  ],
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/attempts/vuln_1/leaked_all.raw",
    "logs/attempts/vuln_1/server.log",
    "logs/attempts/vuln_1/index.html",
    "logs/attempts/vuln_2/leaked_all.raw",
    "logs/attempts/fixed_1/server.log",
    "logs/attempts/fixed_2/server.log",
    "logs/bundle_vuln.log",
    "logs/bundle_fixed.log"
  ],
  "notes": "CVE-2026-66066 confirmed: unauthenticated attacker exfiltrated /proc/self/environ (SECRET_KEY_BASE canary) from the Rails process via crafted .mat (HDF5 external storage) processed by libvips matload through Active Storage :vips variant processing on rails 8.0.5; rails 8.0.5.1 fails closed with Vips::Error 'matload: operation is blocked'."
}