Rails fixes critical Active Storage vulnerability with possible path to remote code execution

Ruby on Rails maintainers have released patches for a critical Active Storage vulnerability that can let unauthenticated attackers retrieve arbitrary files from affected servers and potentially achieve remote code execution.

Tracked as CVE-2026-66066, the issue affects applications that accept image uploads from untrusted users and use libvips to process those files. By submitting a specially crafted image, an attacker may be able to read files accessible to the Rails process. ImageMagick-based configurations are not affected by this particular attack path.

The exposed data could include application source files and process environment variables. Those variables commonly contain the Rails secret_key_base, database passwords, cloud-storage credentials and other secrets. If the signing key is obtained, attackers may be able to forge session cookies, tamper with signed identifiers and abuse serialized data, creating a route to code execution, according to security researchers.

Affected versions and fixes

• Active Storage versions before 7.2.3.2
• Rails 8.0 versions before 8.0.5.1
• Rails 8.1 versions before 8.1.3.1

Rails 6 deployments are affected only when Active Storage has been configured in a non-default manner. Administrators should upgrade to the appropriate patched release and use libvips 8.13 or later. As a temporary control, environments running supported libvips versions can set VIPS_BLOCK_UNTRUSTED or enable the equivalent protection through ruby-vips 2.2.1 and newer. No mitigation is available for applications using older libvips releases.

After patching, organizations should rotate the Rails master key, database and Active Storage credentials, and any other secrets available to the application. The official Rails container images, along with common Debian and Ubuntu installations, use libvips by default, making configuration checks especially important.

Researchers from Ethiack and GMO Flatt Security reported the flaw. Technical details and proof-of-concept material appeared sooner than planned after public exploit code emerged. Akamai has published guidance and released web application firewall protections, while warning that the vulnerability’s impact can extend beyond file disclosure to full server compromise.