Do Son 
TL;DR
Ruby on Rails has patched a critical Rails Active Storage flaw. Tracked as CVE-2026-66066 and rated 9.5 CVSS, it lets an unauthenticated attacker read arbitrary files from the server. Stolen secrets can then escalate to remote code execution. Rails shipped fixes on 29 July 2026.
Why it matters
Active Storage handles file uploads in countless Rails apps. Many accept user images and generate thumbnails by default. So this bug reaches a broad base of production sites.
The stakes are high. A leaked secret_key_base or cloud key can hand an attacker wide access. That includes database logins and third-party API tokens. Researchers at Ethiack and GMO Flatt Security reported the chain.
How the attack works
The root cause lies in libvips, the default image processor. libvips marks some format handlers as “unfuzzed,” meaning they are unsafe for untrusted content. Active Storage did not disable them.
As a result, an attacker can upload a crafted file and trigger variant generation. That action can invoke an unsafe operation and read arbitrary files, including the process environment. Rails withholds the exact attack chain until 28 August 2026.
Affected versions
The Rails Active Storage flaw affects activestorage below 7.2.3.2, 8.0.x below 8.0.5.1, and 8.1.x below 8.1.3.1. Apps qualify if they use the vips processor and accept untrusted image uploads. That vips default has shipped since Rails 7.0.
Patch and mitigation
Upgrade Rails to 7.2.3.2, 8.0.5.1, or 8.1.3.1 right away. You also need libvips 8.13 or later, or Active Storage will refuse to boot. Then rotate every secret the app process can read.
Cannot upgrade yet? On libvips 8.13 or later, set the VIPS_BLOCK_UNTRUSTED environment variable to block the unsafe loaders. Read the official Rails security advisory for full guidance. Researchers report no in-the-wild exploitation, and no public proof-of-concept exists yet.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
