Ruby on Rails patches critical Active Storage flaw CVE-2026-66066
This digest was compiled by AI from multiple sources — links to the originals are below.
Ruby on Rails released patches for a critical Active Storage vulnerability tracked as CVE-2026-66066 with a CVSS score of 9.5. The flaw allows unauthenticated attackers to read arbitrary files from servers using libvips image processing, potentially exposing secrets such as secret_key_base and database passwords. Affected users are urged to upgrade to patched versions and rotate all credentials.
The Vulnerability
The flaw sits at the trust boundary between Active Storage and libvips. Rails' advisory says libvips supports loaders and operations marked "unfuzzed" or "untrusted" because they are unsafe for hostile input, and Active Storage did not block them. A crafted image upload can invoke these unsafe operations to read files readable by the Rails worker, including the Rails process environment and secrets like secret_key_base. Generating dedicated variants is not required; both the Vips analyzer and transformer passed untrusted attachments to unsafe operations, as shown in the public patch. Researchers from Ethiack and GMO Flatt Security detailed the attack path, noting that applications using MiniMagick are not exposed through this specific vector.
Affected Versions and Remediation
Affected ranges include Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. Rails 6.0.0 through 6.1.7.10 are vulnerable only when Active Storage is configured to use libvips, which was not the default in Rails 6. Operators must upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1, and ensure libvips 8.13 or later (and ruby-vips 2.2.1 or later when installed). All secrets readable by the application process—including API tokens and cloud credentials—must be rotated immediately after patching. No proof-of-concept exploit was publicly available as of July 29, 2026.
What's Next
Organizations are expected to apply patches and rotate secrets promptly, though the patch does not invalidate credentials already stolen. While no exploit has surfaced yet, the vulnerability's low complexity could lead to rapid exploitation once technical details spread.
1 source
Ruby on Rails patches critical Active Storage flaw CVE-2026-66066
