A critical vulnerability in Ruby on Rails, tracked as CVE-2026-66066, allows unauthenticated attackers to read arbitrary files from vulnerable servers and potentially escalate to remote code execution.
The flaw lies in Active Storage’s image variant processing when configured to use libvips, affecting a wide swath of Rails applications that accept user-uploaded images. The issue stems from how libvips handles file formats through its “loader” and “saver” operations.
Some of these operations are explicitly marked as “unfuzzed” by libvips maintainers, meaning they haven’t been hardened against untrusted input and are unsafe for processing files from unknown sources.
Critical Rails Flaw
Active Storage, in its default configuration, failed to disable these unfuzzed operations. As a result, an attacker who uploads a maliciously crafted file triggering variant generation could invoke one of these unsafe operations.
Rails’ security team confirmed at least one working attack chain that allows disclosure of arbitrary files on the application server’s filesystem, including environment variables.
This is particularly dangerous because server environments typically store secret_key_base, database credentials, and API keys for third-party services.
Exposure of secret_key_base alone can enable attackers to forge signed cookies, session tokens, and Active Storage URLs, opening a path to full remote code execution or lateral movement into connected systems like S3, GCS, or Azure.
An application is vulnerable if it uses libvips for Active Storage image processing, configured via config.active_storage.variant_processor = :vips, which has been the default since Rails 7.0, and if it allows image uploads from untrusted or unauthenticated users.
Notably, generating variants is not a separate requirement; simply accepting uploads under this configuration is enough to expose the flaw.
The affected versions include activestorage<7.2.3.2, activestorage≥8.0 and <8.0.5.1, and activestorage≥8.1 and <8.1.3.1.
Mitigation
Rails maintainers urge affected organizations to upgrade Active Storage to a patched version immediately and ensure libvips is upgraded to version 8.13 or later.
Since versions below this cannot disable unfuzzed operations at all, and patched Active Storage will now raise a boot-time exception in insecure environments.
Beyond the upgrade, teams should rotate secret_key_base, the Rails master key, and all credentials stored in credentials.yml.enc, along with any keys tied to Active Storage services such as S3, GCS, or Azure, as well as database credentials and third-party API tokens.
Organizations unable to upgrade Rails immediately but running libvips ≥8.13 can set the VIPS_BLOCK_UNTRUSTED environment variable, or call Vips.block_untrusted(true) from an initializer if using ruby-vips ≥2.2.1. No workaround exists for libvips versions below 8.13 other than removing the dependency entirely.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
