Ruby on Rails Active Storage arbitrary file read and possible RCE (CVE-2026-66066)

The Rails project's GitHub advisory says an unauthenticated attacker can abuse Active Storage image variant processing with libvips to read arbitrary files accessible to the Rails process, including environment secrets; exposed signing or service credentials can enable remote code execution or lateral movement. The affected configuration uses libvips for Active Storage and accepts untrusted image uploads. SecurityWeek reported on 31 August that VulnCheck had observed exploitation. Upgrade Active Storage to 7.2.3.2, 8.0.5.1 or 8.1.3.1, use libvips 8.13 or later, and rotate secret_key_base plus every other secret readable by the application process. Rails branches without a fixed release should move to a supported branch or remove libvips until they can patch.

Product

Ruby on Rails Active Storage with libvips

Versions

activestorage < 7.2.3.2; >= 8.0, < 8.0.5.1; >= 8.1, < 8.1.3.1

CVSS

9.5 (CVSS 4.0, GitHub CNA)

Exploited in Australia?

unknown

Patch to

Active Storage 7.2.3.2 / 8.0.5.1 / 8.1.3.1 and libvips >= 8.13

Primary: Rails/GitHub security advisory (29 Jul 2026) · Vendor: Rails security advisory · CVE: CVE-2026-66066 · SecurityWeek (31 Aug 2026)

vulnerabilities