Critical Ruby on Rails Flaw Allows Unauthenticated File Reads via Image Uploads
A critical vulnerability in Ruby on Rails' Active Storage component, CVE-2026-66066, allows unauthenticated attackers to read sensitive server files by uploading crafted images.
Ruby on Rails has issued urgent patches for a critical vulnerability, CVE-2026-66066, affecting its Active Storage component. This flaw, with a severe CVSS score of 9.5, enables unauthenticated attackers to read arbitrary files from application servers by exploiting a weakness in image processing. The vulnerability could expose highly sensitive information, including the Rails process environment, secret keys, database passwords, and cloud storage credentials, potentially leading to remote code execution or lateral movement within compromised networks.
The vulnerability specifically impacts applications that utilize the libvips library for Active Storage image processing and accept image uploads from untrusted users. According to researchers from Ethiack and GMO Flatt Security, affected versions include Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. While Rails 6.0.0 through 6.1.7.10 are also vulnerable, this is only if Active Storage is configured to use Vips, as it was not the default processor in those earlier versions. The official advisory broadens the affected range to activestorage < 7.2.3.2, with practical exploitation paths identified from Rails 6.0 onwards when using Vips.
Applications running on Rails 7.0 and 7.1, which are now end-of-life, are particularly at risk as they will not receive direct fixes and must upgrade to Rails 7.2.3.2 or later. For other affected versions, developers are urged to upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1. Crucially, organizations must also rotate any secrets that could have been read by the application process. The security update also requires libvips version 8.13 or later, and if ruby-vips is installed, version 2.2.1 or later.
As of the disclosure, neither research team had released a proof-of-concept (PoC) exploit, and initial searches of public exploit repositories showed no immediate public availability. However, Rails has cautioned that applying the patch does not invalidate credentials that may have already been compromised. The vulnerability lies in the interaction between Active Storage and libvips, where Active Storage failed to properly block potentially unsafe operations invoked by libvips, some of which are backed by third-party libraries and considered untrusted.
Exploiting this flaw grants attackers an arbitrary file-read capability. The subsequent impact, such as achieving code execution or moving laterally within a network, depends entirely on the sensitive data extracted and the access those credentials provide. To mitigate this, Rails strongly advises rotating critical secrets including secret_key_base, the master key, decrypted credentials, database credentials, Active Storage service keys, and any third-party API tokens.
As a temporary mitigation for those unable to immediately update Rails, the VIPS_BLOCK_UNTRUSTED environment variable can be set when running libvips 8.13 or later. Alternatively, developers can call Vips.block_untrusted(true) directly with ruby-vips 2.2.1 or later. For older libvips versions that cannot enforce this blocking, upgrading libvips or removing it entirely from the application is necessary.
The vulnerability was independently reported by André Baptista, Bruno Mendes, and Rafael Castilho of Ethiack, and RyotaK of GMO Flatt Security. While the specific attack chain and malicious file formats remain undisclosed by the researchers, Rails has committed to releasing further technical details by August 28, 2026. At the time of reporting, there was no indication of active exploitation in the wild, and the CVE was not yet listed on CISA's Known Exploited Vulnerabilities catalog.