417/69 Monday, August 3, 2026
Ruby on Rails has released a security update to fix a Critical vulnerability in Active Storage, tracked as CVE-2026-66066, with a CVSS score of 9.5. The vulnerability could allow unauthenticated attackers to read files on affected servers and may lead to remote code execution or lateral movement if attackers can access secrets or credentials used by the application.
Reports indicate that the vulnerability affects Ruby on Rails applications that use libvips to process images through Active Storage and allow untrusted users to upload image files. Attackers could upload specially crafted files to cause the image variant generation process to read files accessible to the application, including data in the process environment. This data may contain secret_key_base, master keys, storage service credentials such as S3, GCS, or Azure credentials, database credentials, and third-party service tokens.
Administrators and developers using Ruby on Rails should update Active Storage to version 7.2.3.2, 8.0.5.1, or 8.1.3.1, and update libvips to version 8.13 or later as soon as possible. If an application falls within the affected scope, organizations should assume that secrets accessible to the application may have been exposed and rotate secret_key_base, master keys, credentials, API tokens, and related passwords. They should also review logs for abnormal file uploads and unusual image variant generation activity. According to the report, there is currently no evidence that the vulnerability has been actively exploited.
Source: https://www.securityweek.com/ruby-on-rails-patches-critical-vulnerability/