A severe security vulnerability in Ruby on Rails Active Storage tracked as CVE-2026-66066 can let unauthenticated attackers read sensitive files from a server and potentially escalate to remote code execution.
The issue affects applications that use libvips for image variant processing and accept image uploads from untrusted users, putting secrets such as secret_key_base, cloud credentials, and database passwords at risk if left unpatched.
In a default Rails setup that displays image variants, an attacker who uploads a crafted file and triggers variant generation may abuse how libvips handles certain file formats.
Libvips processes formats through loaders and savers backed by third-party libraries, and it marks some of those operations as “unfuzzed,” meaning they are unsafe for untrusted content.
Critical Rails Code Execution Vulnerability
Several of those operations also handle formats unrelated to typical web images. Active Storage did not disable these unfuzzed operations, so a malicious upload could invoke one of them.
Researchers have demonstrated a chain that discloses the contents of arbitrary files accessible to the application process. That often includes the process environment, where secret_key_base and credentials for external systems commonly live, opening a path to remote code execution or lateral movement into connected services.
An application is affected when it uses libvips for Active Storage image processing typically via config.active_storage.variant_processor = :vips, the default since Rails 7.0 load defaults—and allows image uploads from untrusted users. Generating variants is not a separate requirement for exposure.
Vulnerable package ranges include activestorage versions below 7.2.3.2, 8.0.x below 8.0.5.1, and 8.1.x below 8.1.3.1. Fixed releases are available through the usual Rails distribution channels.
The minimum supported libvips version for a secure configuration is 8.13 or later. Earlier libvips builds cannot disable unfuzzed operations at all, and Active Storage will raise an exception during boot in that unsecurable environment.
Administrators should upgrade activestorage to a fixed release and ensure libvips is at least 8.13. Patching stops further exploitation but does not undo secrets that may already have been stolen. Every secret readable by the application process should be treated as potentially exposed and rotated.
That includes secret_key_base, the master key from config/master.key or RAILS_MASTER_KEY and everything decrypted from config/credentials.yml.enc, Active Storage service keys for S3, GCS, or Azure, database credentials, and tokens for third-party APIs.
Changing secret_key_base expires active sessions and forces users to sign in again; encrypted cookies, signed cookies, signed global IDs, and Active Storage URLs are also affected. Rotation should be temporary only if needed—do not keep an exposed secret as a fallback.
Where an immediate Rails upgrade is not possible, limited workarounds exist. With libvips 8.13 or newer, setting the VIPS_BLOCK_UNTRUSTED environment variable blocks untrusted operations at libvips initialization. Applications using ruby-vips 2.2.1 or later can instead call Vips.block_untrusted(true) from an initializer.
On libvips older than 8.13 there is no safe workaround other than removing the libvips dependency, for example by dropping ruby-vips from the Gemfile when it is used only for image analysis or when Active Storage is not in use.
Technical details of the attack chain are intentionally withheld so operators can focus on upgrading without giving attackers a ready-made playbook. Full disclosure is planned no later than August 28, 2026, through the Rails Security Announcements forum.
The issue was responsibly reported by 0xacb, s3np41k1r1t0, and castilho from Ethiack, and by RyotaK from GMO Flatt Security Inc. Organizations running Rails with Active Storage and libvips should prioritize patching, secret rotation, and verification that unfuzzed operations are blocked before untrusted uploads are accepted again.
