Rails Patches Critical Active Storage Vulnerability

Recently, Rails announced patches for a critical vulnerability in the Active Storage framework that could allow unauthenticated attackers to read arbitrary files from a Rails application and potentially escalate to remote code execution (RCE). The vulnerability, tracked as CVE-2026-66066, has been rated as critical severity by the Rails maintainers. It affects Active Storage versions prior to 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. The exploit conditions require that the server allows image uploads from untrusted users and utilizes the libvips library for image processing. An attacker could upload a specially crafted image file to read arbitrary files on the server, including the process environment that typically contains sensitive information such as database credentials and cloud storage keys. The Rails team recommends upgrading to libvips version 8.13 or later and rotating all application secrets and credentials. It is noteworthy that, while there is currently no evidence of the vulnerability being exploited in the wild, the potential risks associated with it should not be overlooked.