- Ruby on Rails patched a critical Active Storage vulnerability, CVE-2026-66066 (CVSS 9.5), allowing unauthenticated file read on servers using libvips.
- Attackers can extract
secret_key_base, database passwords, cloud storage credentials, and API tokens, potentially enabling remote code execution or lateral movement. - Affected versions include Rails 7.0 through 7.2.3.1, 8.0.0–8.0.5, and 8.1.0–8.1.3; operators must upgrade to patched releases and rotate all exposed secrets.
Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS 9.5), the flaw exposes the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, and cloud storage credentials.
Affected applications use libvips for Active Storage image processing and accept image uploads from untrusted users. The Rails security advisory explains that libvips supports loaders and savers backed by third-party libraries marked “untrusted.” Active Storage did not block them, allowing a crafted upload to invoke one and disclose files readable by the Rails worker.
Ethiack and GMO Flatt Security list the affected ranges as Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. The official advisory notes that activestorage < 7.2.3.2 is vulnerable, and applications using MiniMagick are not exposed through this specific attack path.
Operators should upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate every secret readable by the application process. The patch calls Vips.block_untrusted(true) when Active Storage starts, and patched installations require libvips 8.13 or later.
Rails credited André Baptista, Bruno Mendes, and Rafael Castilho of Ethiack, and RyotaK of GMO Flatt Security, with independently reporting the issue. Neither research team had published a proof-of-concept by 17:30 UTC on July 29, 2026, and no in-the-wild exploitation was reported.
The flaw was not listed in CISA's Known Exploited Vulnerabilities catalog as of version 2026.07.27. Rails warned that applying the patch does not invalidate credentials that may already have been stolen.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
