Rails Fixes Critical Active Storage File-Read Vulnerability
BleepingComputer reported that Rails maintainers patched CVE-2026-66066, a critical Active Storage flaw tied to libvips image processing and possible file exposure in vulnerable applications.
A critical Active Storage vulnerability has moved Rails security work from ordinary patching to credential containment, BleepingComputer reported, because vulnerable applications can expose server files when untrusted image uploads are processed with libvips.
The Rails advisory tracks the flaw as CVE-2026-66066 and gives it a critical severity rating.
Active Storage handles file uploads and attachments in Rails applications, so the affected surface sits inside a common web-application workflow rather than a separate optional security product.
Vulnerable Image Processing Is The Gate
The security bulletin says exploitation depends on libvips being used for image processing and on the application accepting image uploads from untrusted users.
In that configuration, a crafted image can let an unauthenticated attacker read arbitrary files from the server, with possible escalation to remote code execution.
The operational risk comes from what those files may contain.
Environment data and application files can include the Rails secretkeybase, database credentials, cloud storage credentials and other service secrets available to the application process.
A file-read bug can therefore become a broader credential rotation event for teams that exposed the vulnerable path.
Patched Rails Versions Narrow The Upgrade Path
The affected ranges span current Active Storage release lines, including the patched 8.0.x series and older maintained builds, according to the Rails advisory.
Exposure in Rails 6.x is narrower because it depends on a non-default Active Storage configuration.
According to the Rails security bulletin, deployments should upgrade to libvips 8.13 or later, and systems already on libvips 8.13 or later can use VIPSBLOCKUNTRUSTED or Vips.block_untrusted(true) as temporary controls when ruby-vips 2.2.1 or newer is in use.
Operators also need to replace the framework master key and review database, storage and service credentials that the running application could read, because the bug class is file exposure rather than only upload failure.
Default Stack Choices Matter
ImageMagick users are not affected by this vector, but libvips is the default processor in official Rails Docker images and in Debian and Ubuntu setups.
That default matters for teams that adopted standard deployment images without separately reviewing how upload processing touches server-side files.
The maintainers withheld full technical details to reduce exploitation risk while users patch.
The source record listed August 28 as the initial date for fuller disclosure on the Rails forums, leaving administrators with a short-term checklist: upgrade the affected components, identify untrusted upload paths and rotate secrets where vulnerable processing may have exposed application state.
