Rails Patches Critical Active Storage Flaw That Can Expose Files and Enable RCE
Summary
CVE-2026-66066 lets unauthenticated attackers read arbitrary files from Rails Active Storage apps when libvips processes untrusted uploads, potentially exposing secrets and enabling RCE. Rails urges upgrades, secret rotation, and temporary protections.
Key points
- The flaw affects Active Storage versions before 7.2.3.2, 8.0.5.1, and 8.1.3.1; Rails 6.x is affected only when Active Storage is configured outside its defaults.
- Exploitation requires libvips and uploads from untrusted users; a specially crafted image can trigger arbitrary file reads without authentication.
- Read files may include the application process environment, potentially exposing secret_key_base and database, cloud-storage, and other service credentials.
- Akamai warns that compromised secret_key_base could enable forged session cookies and serialized data manipulation, potentially leading to RCE.
- Rails recommends upgrading and rotating accessible secrets. With libvips 8.13 or later, administrators can temporarily block the vulnerable functionality; no workaround is available for earlier libvips versions.
- ImageMagick is not affected by this attack vector. Akamai has released WAF protections, which Ethiack says may provide temporary protection.
Article Details
- Vulnerability Types
- Arbitrary file read
- Potential remote code execution
- Severity
- Critical
- Affected Versions
- Active Storage before 7.2.3.2
- Active Storage 8.0.x before 8.0.5.1
- Active Storage 8.1.x before 8.1.3.1
- Rails 6.x when Active Storage is configured outside its defaults
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- With libvips 8.13 or later, set the VIPS_BLOCK_UNTRUSTED environment variable to disable the vulnerable functionality.
- With ruby-vips 2.2.1 or newer, call Vips.block_untrusted(true) to disable the vulnerable functionality.
- No workaround is available for apps using libvips before 8.13.
MITRE ATT&CK
CVE
Vendors
Products
Active StorageA critical flaw in Rails Active Storage, tracked as CVE-2026-66066, can let an unauthenticated attacker read arbitrary files and potentially achieve remote code execution when libvips is used.ImageMagickActive Storage may also generate image thumbnails from uploaded media using image processing libraries such as libvips or ImageMagick.libvipsA critical flaw in Rails Active Storage, tracked as CVE-2026-66066, can let an unauthenticated attacker read arbitrary files and potentially achieve remote code execution when libvips is used.RailsA critical flaw in Rails Active Storage, tracked as CVE-2026-66066, can let an unauthenticated attacker read arbitrary files and potentially achieve remote code execution when libvips is used.ruby-vipssetting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) when using ruby-vips 2.2.1 or newer.