A critical security vulnerability in the Ruby on Rails framework could allow unauthenticated attackers to access sensitive files from application servers by uploading specially crafted image files.
Tracked as CVE-2026-66066 with a CVSS severity score of 9.5, the flaw affects Rails applications using Active Storage with the libvips image processing library. Successful exploitation could expose critical server data, including encryption keys, database credentials, cloud service tokens, and application secrets.
Vulnerability Targets Active Storage Image Processing
The security issue exists in the interaction between Rails Active Storage and libvips, a library commonly used for processing uploaded images.
Researchers found that certain image-processing functions supported by libvips could handle unsafe file operations when processing attacker-controlled uploads. Because Active Storage did not sufficiently restrict these operations, attackers could craft malicious images capable of reading files accessible to the Rails application process.
Affected systems do not necessarily need to offer a separate image-resizing feature. Any application that accepts untrusted image uploads and processes them through vulnerable Active Storage configurations may be at risk.
Potential Impact Includes Data Theft and Remote Access
A successful attack could provide an attacker with the ability to read arbitrary files from the server environment. The exposed information may include:
- Rails secret keys such as
secret_key_base
- Rails master keys
- Database passwords
- Cloud storage credentials
- API access tokens
Security researchers warned that stolen secrets could potentially be used for further attacks, including remote code execution or movement into connected systems.
However, the final impact depends on what information is accessible and the permissions available to the compromised application.
Affected Rails Versions and Required Updates
Security researchers from Ethiack and GMO Flatt Security identified affected versions across multiple Rails releases.
Potentially vulnerable versions include:
- Rails 7.0.0 through 7.2.3.1
- Rails 8.0.0 through 8.0.5
- Rails 8.1.0 through 8.1.3
Rails 6.x versions may also be affected when Active Storage is configured to use libvips, although libvips was not the default image processor in those releases.
Applications using MiniMagick instead of libvips are not affected by this specific vulnerability.
The Rails Security Team recommends upgrading to:
- Rails 7.2.3.2 or later
- Rails 8.0.5.1 or later
- Rails 8.1.3.1 or later
Administrators should also rotate all credentials and secrets that may have been accessible to the Rails application process.
Additional Protection Measures Recommended
Along with upgrading Rails, organizations should ensure they are running secure versions of supporting libraries:
- libvips 8.13 or later
- ruby-vips 2.2.1 or later when used
For organizations unable to immediately update Rails, temporary protections are available by enabling libvips security restrictions through VIPS_BLOCK_UNTRUSTED or configuring Vips.block_untrusted(true) with supported versions.
Older libvips releases do not provide this protection and should be upgraded or removed from affected applications.
Researchers Warn of Possible Exploitation Paths
The vulnerability was independently reported by researchers from Ethiack and GMO Flatt Security. Public technical details and proof-of-concept code had not been officially released at the time of disclosure, although a third-party repository later claimed to demonstrate a complete attack chain in a controlled laboratory environment.
The reported demonstration showed how an attacker could potentially retrieve application secrets and use them for additional exploitation. Researchers cautioned that the proof-of-concept has not been independently verified.
No Confirmed Attacks Reported Yet
The Rails Security Team said it was not aware of active exploitation before or after the vulnerability disclosure. The team also noted that it does not have visibility into how many applications use Active Storage with libvips and allow untrusted image uploads.
Organizations running Rails applications should review their configurations, identify whether libvips is in use, inspect upload workflows, apply available patches, and rotate sensitive credentials as a precaution.
