Ruby on Rails Patches Critical Active Storage Vulnerability Affecting Image Processing
August 03, 2026 
Ruby on Rails fixed a critical vulnerability that could let unauthenticated attackers read files and achieve remote code execution.
Ruby on Rails has patched CVE-2026-66066, a critical vulnerability (CVSS score of 9.5) that could allow unauthenticated attackers to read arbitrary files from vulnerable servers. In the default configuration, applications that generate image variants may expose sensitive data, including environment variables, potentially enabling remote code execution or lateral movement.
“In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment.” reads the advisory. “That environment typically holds secret_key_base and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.”
Organizations should apply the security updates immediately.
The vulnerability affects Ruby on Rails applications using Active Storage with the libvips image processor. libvips relies on several third-party libraries to handle various file formats, including some operations that are marked as unsafe for untrusted files. Because Active Storage did not block these operations, attackers could upload specially crafted images and potentially trigger unintended processing.
“We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application.” continues the advisory. “One specific attack chain has been reported to us (see “Disclosure” below), but we do not assume it is the only one that exists.”
This may allow disclosure of sensitive files stored on the server, including environment variables containing application secrets. Applications are affected when they allow untrusted image uploads and use libvips for variants. The fix is to upgrade Active Storage, update libvips to version 8.13 or later, and rotate exposed secrets such as secret_key_base. Older libvips versions cannot safely disable risky operations.
According to the advisory, patching the Ruby on Rails Active Storage vulnerability is not enough if attackers have already accessed application secrets.
Organizations should consider all secrets handled by the application potentially compromised and rotate them, including secret_key_base, encryption keys, cloud storage credentials, database passwords, and third-party service tokens.
Changing secret_key_base invalidates active sessions, encrypted cookies, signed URLs, and requires users to authenticate again. Exposed secrets should not be kept as backups after rotation. For affected systems using libvips versions older than 8.13, the only mitigation is removing the dependency.
With libvips 8.13 or later, risky “unfuzzed” operations can be disabled through environment settings or ruby-vips configuration. Fixed versions of Active Storage have been released, while technical exploit details will be disclosed later to reduce abuse against unpatched systems.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Ruby on Rails)
