Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Summary: Ruby on Rails released fixes for CVE-2026-66066, a critical Active Storage flaw (CVSS 9.5) that lets unauthenticated attackers read arbitrary files from application servers through crafted image uploads processed by libvips, potentially exposing secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. Affected ranges are Rails 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3, with Rails 6.0.0 through 6.1.7.10 affected only when Active Storage is configured to use Vips; operators should upgrade to 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate every secret readable by the application process.
What's compelling: The Rails Security Team says it has no telemetry or reasonable estimate for how many applications use Active Storage with Vips and accept untrusted image uploads, and Rails 7.1 and earlier are end of life with no backport coming - so the population of exposed deployments is unknown and, for some, unpatchable without an upgrade.