Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability, CVE-2026-66066 (CVSS 9.5), that could allow unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. The flaw affects applications using libvips for image processing and accepting untrusted uploads. Attackers can extract secrets like secret_key_base, database passwords, and cloud storage credentials, potentially enabling remote code execution or lateral movement.

Affected versions include Rails 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3. Rails 6.0.0 through 6.1.7.10 are affected only when Active Storage uses Vips. Patched versions are 7.2.3.2, 8.0.5.1, and 8.1.3.1. Operators must also upgrade libvips to 8.13+ and ruby-vips to 2.2.1+, and rotate all exposed secrets.

The vulnerability stems from Active Storage not blocking unsafe libvips operations. The patch calls Vips.block_untrusted(true) on startup. No PoC or in-the-wild exploitation has been reported as of July 29, 2026. Researchers from Ethiack and GMO Flatt Security are credited.