● Covered by 3 sources · 3 reportsHigh impact2 negative1 neutral
Critical Rails Active Storage Flaw Allows Arbitrary File Read, Potential RCE
Key points
- CVE-2026-66066 is a critical Active Storage vulnerability.
- Allows unauthenticated attackers to read arbitrary server files.
- Affects Rails applications using libvips for image processing.
- Can expose sensitive data like API tokens and database passwords.
- Potential for remote code execution or lateral movement.
Critical Vulnerability Discovered in Ruby on Rails
Ruby on Rails has released patches for a critical Active Storage vulnerability, tracked as CVE-2026-66066. This flaw allows unauthenticated attackers to read arbitrary files from application servers through specially crafted image uploads. The vulnerability has a CVSS score of 9.5.
Mechanism of Attack
The vulnerability is exploitable in Rails applications that use the libvips library for Active Storage image processing and accept image uploads from untrusted users. Attackers can upload a crafted image to read files on the server.
This arbitrary file read can expose sensitive data, including the Rails process environment, secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. Access to these secrets could enable remote code execution (RCE) or lateral movement into connected systems.
Affected Versions and Configurations
The official advisory lists affected versions as activestorage < 7.2.3.2. Research teams specify affected ranges as Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3.
Rails 6.0.0 through 6.1.7.10 releases are affected only if Active Storage is configured to use Vips, as Vips was not the default processor in Rails 6. Rails selects Vips under load_defaults 7.0, and later defaults retain it. Applications using MiniMagick are not affected.
Impact and Mitigation
The exposure of credentials for external systems and the potential for RCE highlight the severity of this vulnerability. Maintainers recommend immediate updates to patched versions.
Beyond patching, organizations should consider rotating credentials that may have been exposed if their applications meet the vulnerability criteria.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub rails/rails CVE CVE-2026-660669.5 CRITICAL CVE CVE-2026-505229.8 CRITICAL GitHub rails/rails-forensics-CVE-2026-66066How outlets covered it
Rails maintainers have patched a critical vulnerability, CVE-2026-66066, in the Active Storage framework that could allow unauthenticated attackers to read arbitrary files and potentially achieve remote code execution. The flaw affects Rails applications using libvips for image processing and allowing untrusted image uploads, necessitating immediate updates and credential rotation.
Ruby on Rails released patches for a critical vulnerability, CVE-2026-66066, which could allow unauthenticated attackers to achieve remote code execution by reading arbitrary files. This vulnerability affects applications using libvips for Active Storage image processing and accepting untrusted image uploads, potentially exposing sensitive data like secret_key_base and external system credentials.
Ruby on Rails has released fixes for a critical Active Storage vulnerability (CVE-2026-66066) that allows unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. This flaw can expose sensitive data like API tokens, database passwords, and the Rails master key, potentially leading to remote code execution or lateral movement.