Critical Rails Vulnerability Allows File Access via Image Uploads

A critical vulnerability in Ruby on Rails’ Active Storage was recently addressed, which could allow unauthorized users to access sensitive files on server systems through manipulated image uploads. This flaw, identified as CVE-2026-66066 with a CVSS score of 9.5, poses a significant risk by potentially exposing critical environment variables and security credentials, including the Rails master key and database passwords, leading to remote code execution and further system compromises.

Vulnerability Details and Affected Versions

The flaw predominantly affects applications utilizing libvips for image processing within Active Storage and accepting uploads from untrusted sources. Rails versions from 7.0.0 to 7.2.3.1, 8.0.0 to 8.0.5, and 8.1.0 to 8.1.3 are vulnerable, with versions 6.0.0 through 6.1.7.10 affected only if Active Storage is configured to use Vips. Applications using MiniMagick are not susceptible to this attack vector.

The official advisory extends the affected package range to activestorage versions below 7.2.3.2. Notably, Rails 7.0 and 7.1 have reached end-of-life status and will not receive patches, necessitating upgrades to at least version 7.2.3.2.

Security Recommendations and Patch Details

To mitigate this vulnerability, Rails operators are advised to upgrade to versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 and to rotate all secrets accessible by the application. Updated systems should use libvips 8.13 or newer, along with ruby-vips 2.2.1 or later if applicable. The patch implements Vips.block_untrusted(true) to block untrusted operations at the start of Active Storage.

For those unable to update Rails immediately, setting the VIPS_BLOCK_UNTRUSTED environment variable is recommended when using compatible libvips or ruby-vips versions. Older libvips versions lack the capability to block these unsafe operations, making an upgrade essential.

Research and Future Outlook

This vulnerability was independently reported by André Baptista, Bruno Mendes, and Rafael Castilho of Ethiack, along with RyotaK from GMO Flatt Security. As of July 29, 2026, no proof-of-concept exploit has been publicly released, and there are no reports of in-the-wild exploitation. The Hacker News has confirmed that CVE-2026-66066 is not listed in CISA’s Known Exploited Vulnerabilities catalog as of the publication date.

Further technical details are expected to be disclosed by August 28, 2026. Rails users are urged to remain vigilant and ensure all systems are updated to protect against potential exploitation.