CVE-2026-66066: Ruby on Rails Active Storage arbitrary file read via libvips

CVE-2026-66066 · Severity: critical · CVSS 4 · Published 2026-07-30

Ruby on Rails applications using the Active Storage component for image processing are vulnerable to a critical security flaw. By uploading a specially crafted image file, an attacker can trick the server into reading sensitive files, such as environment variables and application secrets. This could lead to full system takeover, data theft, or unauthorized access to external services.

Technologies: Ruby on Rails Active Storage, activestorage (RubyGems). Vendors: Ruby on Rails, RubyGems.

Quick answers

Is CVE-2026-66066 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-66066 being exploited in the wild.
How severe is CVE-2026-66066?
Critical severity, with a CVSS score of 4, published 30 July 2026.
Which products and versions are affected?
Ruby on Rails Active Storage < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1; Ruby on Rails Rails (Active Storage) < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1; activestorage (RubyGems) ECOSYSTEM:introduced=0,fixed=7.2.3.2.
Is there a fix for CVE-2026-66066?
Yes. activestorage (RubyGems): upgrade to 7.2.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66066 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-66066?
Check whether you run Ruby on Rails Active Storage, Ruby on Rails Rails (Active Storage) or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • activestorage (RubyGems): upgrade to 7.2.3.2 or later
    bundle update activestorage

Technical details

A vulnerability exists in Rails Active Storage where it fails to disable libvips loaders and savers marked as 'unfuzzed' or 'untrusted'. When an application is configured to use libvips for image processing, an unauthenticated attacker can upload a malicious image that triggers these unsafe operations. This can be exploited to perform arbitrary file reads, exposing sensitive data like 'secret_key_base' or service tokens. Such exposure often leads to remote code execution (RCE). The fix involves calling 'Vips.block_untrusted(true)' during the boot process and requires libvips 8.13+ and ruby-vips 2.2.1+.

Affected products

  • Ruby on Rails Rails (Active Storage) < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1

Identifiers

  • CVE-2026-66066
  • GHSA-xr9x-r78c-5hrm

Timeline

  • 2026-07-29: patched: Fixes committed to Rails repository
  • 2026-07-30: disclosed: CVE published and advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.