CVE-2026-66066 Details

A vulnerability in Ruby on Rails Active Storage component allows unauthenticated attackers to read arbitrary files from the server via crafted image uploads. This issue affects Rails applications using libvips for image processing, and accepting uploads from untrusted users. The vulnerability arises because Active Storage does not disable certain libvips operations deemed unsafe for untrusted content. Exploitation can lead to the disclosure of sensitive information such as environment variables and application secrets, including the secret_key_base, which could facilitate remote code execution or unauthorized access to external services.

Upgrade to Ruby on Rails versions 7.2.3.2, 8.0.5.1, or 8.1.3.1. After upgrading, ensure that the minimum version of libvips is 8.13 and, if ruby-vips is installed, that it is version 2.2.1 or later. Additionally, rotate any secrets accessible by the application process, including the secret_key_base, the Rails master key, database credentials, and tokens for third-party services.