cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Ruby on Rails Patches Critical Active Storage Vulnerability

· Original article ↗

Summary

CVE-2026-66066 can expose arbitrary server files in affected Rails Active Storage deployments using libvips, potentially enabling code execution. Patches are available; Rapid7 reported no evidence of exploitation in the wild as of July 30.

Key points

  • CVE-2026-66066 is rated critical with a CVSS score of 9.5.
  • The issue affects applications using libvips for Active Storage image processing that accept untrusted image uploads.
  • A crafted upload may trigger unsafe file operations and expose files accessible to the application, including its process environment.
  • Exposed secrets, including secret_key_base and external-system credentials, could potentially enable further attacks, including remote code execution.
  • Fixes are available in Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1; libvips should also be updated to at least version 8.13.
  • Rails maintainers advise treating readable secrets as potentially exposed and changing them if an affected application may have been compromised.
  • Rapid7 reported no evidence of exploitation in the wild as of July 30.

Article Details

Vulnerability Types
  • Arbitrary file read
  • Remote code execution
Severity
Critical (CVSS 9.5)
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1005 · Data from Local SystemThe vulnerability can let an attacker read arbitrary files accessible to the application, including process environment contents and secrets.T1190 · Exploit Public-Facing ApplicationAn unauthenticated attacker can exploit the vulnerability in a Rails application to read arbitrary server files and potentially achieve remote code execution.

CVE

CVE-2026-66066Vendor / Product unavailableTracked as CVE-2026-66066 (CVSS score of 9.5), the critical security defect is described as an arbitrary file read that potentially exposes secrets, allowing remote attackers to execute code or move laterally to other

Products

Active StorageThe issue impacts applications that use the libvips library for Active Storage image processing and that allow image uploads from untrusted users.libvipsThe issue impacts applications that use the libvips library for Active Storage image processing and that allow image uploads from untrusted users.Ruby on RailsRuby on Rails this week rolled out patches for a critical vulnerability that could allow unauthenticated attackers to achieve remote code execution (RCE).