Rails patches Active Storage flaw that allows file reads, RCE

Ruby on Rails released patches for a critical Active Storage vulnerability tracked as CVE-2026-66066. The flaw, rated CVSS 9.5, can allow an unauthenticated user to upload a crafted image that forces the server to disclose files and potentially lead to remote code execution. Fixes are included in Active Storage versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

The defect occurs when an application uses the libvips native library for image processing and accepts uploads from untrusted sources. Libvips marks some file read and write operations as “unfuzzed” so they skip certain checks; Active Storage did not disable those unfuzzed operations by default. A crafted upload can invoke an unfuzzed operation and cause the application to read files accessible to its process.

Files that can be exposed include environment variables and Rails secrets such as secret_key_base, plus stored credentials for external services. Those items could be used to escalate privileges, move laterally inside an environment, or to obtain the ability to run code on the server if abused.

Rails maintainers and the advisory recommend updating Active Storage to the patched releases and upgrading libvips to at least version 8.13, because older libvips versions do not support disabling unfuzzed operations. The advisory warns that applying updates does not recover any secrets that may already have been taken and recommends treating every secret readable by the application as potentially exposed and replacing it.

A security firm reported that, as of July 30, it had found no evidence the vulnerability had been exploited in the wild. The Rails advisory states: “We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application.”

For teams that cannot apply the patches immediately, the advisory suggests blocking uploads from untrusted users, disabling image processing, or restricting access to the application until updates are in place. After patching, operators are advised to rotate any keys, tokens or credentials the application can read and to review logs for unusual activity around file uploads and image processing.

Active Storage handles file uploads and image variants in Rails applications, and libvips is a native library widely used for fast image operations. The patched Active Storage releases add checks that disable unfuzzed libvips operations when processing user-supplied images.