Ruby on Rails has addressed a critical vulnerability in its Active Storage component that could allow unauthenticated attackers to read arbitrary files from application servers through specially crafted image uploads. This flaw, identified as CVE-2026-66066 with a CVSS score of 9.5, poses significant risks, including the potential exposure of sensitive information such as the Rails master key, database passwords, and API tokens. Such exposure could lead to remote code execution or unauthorized access to connected systems.
The vulnerability affects applications utilizing libvips for image processing within Active Storage and accepting image uploads from untrusted users. Specifically, Rails versions 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 are impacted. Notably, Rails 6.0.0 through 6.1.7.10 are also vulnerable if configured to use Vips, though this was not the default processor in Rails 6. Applications employing MiniMagick for image processing are not susceptible to this particular flaw.
To mitigate this issue, Rails has released patched versions: 7.2.3.2, 8.0.5.1, and 8.1.3.1. Administrators are strongly advised to upgrade to these versions promptly and to rotate all secrets accessible by the application process. The patches require libvips version 8.13 or later and, if ruby-vips is installed, ruby-vips version 2.2.1 or later.
The root cause of the vulnerability lies in the interaction between Active Storage and libvips. Libvips supports various operations, some of which are backed by third-party libraries marked as “unfuzzed” or “untrusted” due to their unsafe handling of hostile input. Active Storage did not previously block these operations, allowing crafted uploads to invoke them and disclose files readable by the Rails worker.
To address this, the patch introduces a call to Vips.block_untrusted(true) when Active Storage initializes. For applications unable to immediately update Rails, setting the environment variable VIPS_BLOCK_UNTRUSTED with libvips 8.13 or later, or calling Vips.block_untrusted(true) with ruby-vips 2.2.1 or later, can serve as temporary mitigations. However, earlier versions of libvips cannot block these unsafe operations, necessitating an upgrade or removal of libvips from the application.
As of July 29, 2026, no proof-of-concept exploits have been publicly disclosed. Nevertheless, Rails has cautioned that applying the patch does not invalidate credentials that may have already been compromised. Therefore, it is imperative for operators to rotate critical secrets, including secret_key_base, the master key, database credentials, Active Storage service keys, and third-party tokens.
This incident underscores the importance of rigorous input validation and the need for developers to be aware of the security implications when integrating third-party libraries. Ensuring that all components of an application are configured securely is crucial to prevent similar vulnerabilities. Organizations should also establish robust monitoring and incident response protocols to detect and mitigate potential exploits promptly.
