CVE-2026-66066: Critical Rails Flaw Exposes Server Files via Image Uploads

Ruby on Rails has released security updates for a critical Active Storage vulnerability that can allow an unauthenticated attacker to read arbitrary files from an application server through crafted image uploads. Tracked as CVE-2026-66066 and rated 9.5 on the CVSS scale, the flaw can expose secrets accessible to the Rails process and potentially enable remote code execution or lateral movement into connected systems. The issue stems from the interaction between Active Storage and libvips, the image-processing library selected by Rails applications using load_defaults 7.0 and later defaults. In a default Rails setup that accepts image uploads from untrusted users, unsafe libvips operations may process a malicious file and disclose data that should never be accessible through an uploaded image. The most important details for CVE-2026-66066 concern the sensitivity of the potentially exposed information. An attacker may retrieve the Rails process environment, secret_key_base, the Rails master key, database credentials, cloud storage keys, and third-party API tokens. Depending on the secrets obtained, the attack can progress from arbitrary file disclosure to session forgery, application compromise, or access to external infrastructure. CVE-2026-66066 analysis The weakness resides in Active Storage variant processing when the application uses libvips. Libvips supports numerous loaders, savers, and other operations for handling file formats. Some of these operations depend on third-party libraries and are classified as “unfuzzed” or untrusted because they are unsafe for processing hostile input. Active Storage did not block these operations before passing uploaded attachments to the Vips analyzer and transformer. As a result, a crafted upload can invoke an unsafe operation and obtain the contents of arbitrary files readable by the Rails worker. In the most serious scenarios, attackers read server files via image uploads and recover sensitive values from the application environment. The flaw does not require a dedicated resize or thumbnail feature to be exposed. According to the Rails advisory, generating image variants is not a separate requirement for an application to be vulnerable. CVE-2026-66066 affects applications that meet both of the following conditions: - They use libvips for Active Storage image processing, typically through config.active_storage.variant_processor = :vips. - They allow untrusted users to upload images. The reported affected ranges include Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. Rails 6.0 and 6.1 applications can also be exposed when administrators explicitly configure Vips as the image processor, although it was not the default for those releases. Applications that use MiniMagick instead of Vips are not exposed through this particular attack path. Once arbitrary file reading is achieved, attackers may target: - secret_key_base - config/master.key or the RAILS_MASTER_KEY environment variable - Secrets decrypted from config/credentials.yml.enc - Database usernames and passwords - Amazon S3, Google Cloud Storage, or Azure storage keys - Tokens for payment, messaging, monitoring, and other third-party services Obtaining secret_key_base can be particularly dangerous because Rails uses it to protect signed and encrypted application data. Depending on the application and available gadget chains, a stolen value may allow an attacker to forge trusted data and potentially progress to code execution. Cloud or API credentials may also support lateral movement beyond the compromised Rails server. A third-party CVE-2026-66066 PoC appeared shortly after the coordinated disclosure and claims to reproduce an arbitrary-file-read-to-RCE chain in an isolated Docker environment. The Hacker News had not independently verified that code at the time of its updated report, while the original research teams had intentionally withheld detailed exploit mechanics to give administrators time to patch. There are currently no vendor-published CVE-2026-66066 IOCs or confirmed reports of exploitation in the wild. The Rails Security Team said it was not aware of exploitation attempts before or after disclosure, but the absence of known attacks should not be interpreted as evidence that exposed applications are safe. CVE-2026-66066 Mitigation Administrators should upgrade Active Storage to one of the following fixed releases: - Rails 7.2.3.2 or later - Rails 8.0.5.1 or later - Rails 8.1.3.1 or later Rails 7.0 and 7.1 are no longer under security support and will not receive a backported fix. Applications running those branches should migrate to Rails 7.2.3.2 or a newer supported release. The patched configuration also requires libvips 8.13 or later. Applications that directly use the ruby-vips gem should run ruby-vips 2.2.1 or later. The fix calls Vips.block_untrusted(true) during Active Storage initialization, preventing unsafe libvips operations from processing hostile uploads. Updating closes the vulnerable processing path, but it does not invalidate secrets that may already have been disclosed. Organizations should treat every value readable by the Rails application process as potentially compromised and rotate it. This includes application signing secrets, master keys, database credentials, storage service keys, and third-party tokens. Changing secret_key_base will invalidate active sessions and require users to sign in again. It also affects encrypted cookies, signed cookies, signed global IDs, and previously issued Active Storage URLs. Administrators should not retain an exposed secret as a fallback after rotation. When an immediate Rails upgrade is not possible, applications using libvips 8.13 or later can set the following environment variable: VIPS_BLOCK_UNTRUSTED Applications using ruby-vips 2.2.1 or later can alternatively add the following call to an initializer: Vips.block_untrusted(true) Libvips versions older than 8.13 cannot block the unsafe operations. In those environments, there is no secure configuration-only workaround. Administrators must upgrade libvips or remove the dependency, such as by removing ruby-vips from the Gemfile where it is not required. CVE-2026-66066 detection should begin with an inventory of applications using Active Storage, Vips, and untrusted image uploads. Security teams should review application and proxy logs for unusual upload activity, unexpected image formats, repeated variant-processing errors, and requests followed by suspicious session or credential use. To Detect CVE-2026-66066 exposure, teams should verify the exact Active Storage, libvips, and ruby-vips versions rather than relying on the main Rails version alone. Applications should also be reviewed for evidence of unauthorized access involving credentials that were available to the Rails process. FAQ What is CVE-2026-66066 and how does it work? CVE-2026-66066 is a critical arbitrary file-read vulnerability in Ruby on Rails Active Storage. Active Storage allowed unsafe libvips operations to process attacker-controlled uploads, enabling an unauthenticated user to retrieve files readable by the Rails application process. Stolen application secrets may then support remote code execution or lateral movement. When was CVE-2026-66066 first discovered? The private discovery dates have not been publicly disclosed. The issue was independently reported by researchers from Ethiack and GMO Flatt Security, and the coordinated Rails security advisory was published on July 29, 2026. What is the impact of CVE-2026-66066 on systems? The direct impact is arbitrary file disclosure. Attackers may obtain application signing secrets, Rails credentials, database passwords, cloud storage keys, or third-party tokens. Depending on the exposed data and application configuration, the compromise may escalate to session forgery, remote code execution, or access to connected services. Can CVE-2026-66066 still affect me in 2026? Yes. Rails applications remain exposed if they use a vulnerable Active Storage version, process images with libvips, and accept uploads from untrusted users. End-of-life Rails 7.0 and 7.1 applications are also at risk and must be upgraded to a supported branch. How can I protect myself from CVE-2026-66066? Upgrade to Rails 7.2.3.2, 8.0.5.1, 8.1.3.1, or a later release; ensure libvips is version 8.13 or newer; and use ruby-vips 2.2.1 or later where applicable. Rotate all secrets available to the application process and review upload activity for possible exploitation.