Critical Rails Flaw Could Let Unauthorized Attackers Read Server Files Via Image Uploads
Ruby on Rails has released fixes for a Critical Active Storage vulnerability that could allow unauthenticated attackers to read arbitrary files from application servers via crafted image uploads.
Tracked as CVE-2026-66066 (CVSS score: 9.5), the bug can reveal the nature of the Rails process and secrets like secret_key_baseRails master key, database passwords, cloud storage credentials, and API tokens. Those secrets may enable remote code execution (RCE) or collective motion in connected systems.
Affected applications use libvips for Active Storage image processing and accept image uploads from untrusted users. Rails selects Vips below load_defaults 7.0and the latest default keeps it.
Ethiack and GMO Flatt Security list the affected ranges as Rails 7.0.0 to 7.2.3.1, Rails 8.0.0 to 8.0.5, and Route 8.1.0 to 8.1.3. Rails 6.0.0 to 6.1.7.10 releases are only affected when Active Storage is configured to use Vips, which was not the default processor in Rails 6.
Legal advice is included in the comprehensive package list: activestorage < 7.2.3.2. Both research groups put the Vips attack method in Rails 6.0 and later. Programs that use MiniMagick are not exposed to this particular attack method. Rails 7.0 and 7.1 are end-of-life and do not have stable releases, so applications in those branches must upgrade to Rails 7.2.3.2 or later.
Users must upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate all readable secrets through the application process. The attached installation requires libvips 8.13 or later and, if ruby-vips is installed, ruby-vips 2.2.1 or later.
No research team has published a proof of concept (PoC) as of 17:30 UTC July 29, 2026. A real-time search by Hacker News did not find an exploit repository in the indexed GitHub results, GitLab, Exploit-DB, or Packet Storm at the same time. Rails cautioned that applying this patch does not invalidate credentials that may have already been stolen.
The error lies in the trust boundary between Active Storage and libvips. The Rails security advisor says that libvips supports loaders, savers, and other functions, some of which are supported by third-party libraries and are marked as “bugged” or “untrusted” because they are not safe from hostile installation. Active Storage didn’t block them, allowing uploads designed to request one and expose files readable by the Rails worker.
A vulnerable application does not need to expose a dedicated size or icon function. “Differential productivity is not a separate requirement,” Rails said. The public episode also shows that both the Vips analyzer and the transformer have bypassed unreliable attachments for unsafe operation.
A successful request provides the attacker with random file reads. Code execution or lateral movement will depend on what the attacker is extracting and what that information can access. The railroad tells the conductors to go around secret_key_basemaster key and decrypted credentials, database credentials, Active Storage service keys, and third-party tokens.
Patch is calling Vips.block_untrusted(true) when Active Storage starts. Apps that can’t quickly update Rails can be set up VIPS_BLOCK_UNTRUSTED when using libvips 8.13 or later, or call Vips.block_untrusted(true) with ruby-vips 2.2.1 or later. Rails says that earlier versions of libvips cannot block these functions, so applications must upgrade lipbvips or remove it from the application.
Rails credits André Baptista, Bruno Mendes, and Rafael Castilho of Ethiack, as well as RyotaK of GMO Flatt Security, for independently reporting this issue. The researchers did not disclose the malicious format, the readable structure of the file, or the RCE chain. Rails said more technical details will be released before August 28, 2026.
Hacker News contacted the Rails security team about the exploit and the affected versions, as well as Ethiack about the chain of attacks.
Neither Rails nor the researchers reported the exploit in the wild in the publication. A review of The Hacker News at 17: 30 UTC on July 29 found out that CVE-2026-66066 was not listed in version 2026.07.27 of CISA’s Known Exploited Vulnerabilities catalog.
No reliable number of vulnerable applications or identified victims is available. A score of 9.5 describes severity under CVSS, not how much use is exposed: vulnerable deployments must also use Vips, accept untrusted image uploads, and include an exploit in the libvips build.
