# CVE-2026-66066: Ruby on Rails Active Storage arbitrary file read via libvips

Source: https://junglewise.ai/threats/cve-2026-66066-ruby-on-rails-active-storage-arbitrary-file-read-via-libvips  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-66066 · Severity: critical · CVSS 4 · Published 2026-07-30

Ruby on Rails applications using the Active Storage component for image processing are vulnerable to a critical security flaw. By uploading a specially crafted image file, an attacker can trick the server into reading sensitive files, such as environment variables and application secrets. This could lead to full system takeover, data theft, or unauthorized access to external services.

Technologies: [Ruby on Rails Active Storage](https://junglewise.ai/threats/technologies/active-storage), [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage). Vendors: [Ruby on Rails](https://junglewise.ai/threats/vendors/ruby-on-rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-66066 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66066 being exploited in the wild.

**How severe is CVE-2026-66066?** Critical severity, with a CVSS score of 4, published 30 July 2026.

**Which products and versions are affected?** Ruby on Rails Active Storage < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1; Ruby on Rails Rails (Active Storage) < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1; activestorage (RubyGems) ECOSYSTEM:introduced=0,fixed=7.2.3.2.

**Is there a fix for CVE-2026-66066?** Yes. activestorage (RubyGems): upgrade to 7.2.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66066 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66066?** Check whether you run Ruby on Rails Active Storage, Ruby on Rails Rails (Active Storage) or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- activestorage (RubyGems): upgrade to 7.2.3.2 or later

  ```sh
  bundle update activestorage
  ```


## Technical details

A vulnerability exists in Rails Active Storage where it fails to disable libvips loaders and savers marked as 'unfuzzed' or 'untrusted'. When an application is configured to use libvips for image processing, an unauthenticated attacker can upload a malicious image that triggers these unsafe operations. This can be exploited to perform arbitrary file reads, exposing sensitive data like 'secret_key_base' or service tokens. Such exposure often leads to remote code execution (RCE). The fix involves calling 'Vips.block_untrusted(true)' during the boot process and requires libvips 8.13+ and ruby-vips 2.2.1+.

## Affected products

- Ruby on Rails Rails (Active Storage) < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1

## Identifiers

- CVE-2026-66066
- GHSA-xr9x-r78c-5hrm

## Timeline

- 2026-07-29: patched: Fixes committed to Rails repository
- 2026-07-30: disclosed: CVE published and advisory released

## References

- [https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e](https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e)
- [https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5](https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5)
- [https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a](https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a)
- [https://github.com/rails/rails/releases/tag/v7.2.3.2](https://github.com/rails/rails/releases/tag/v7.2.3.2)
- [https://github.com/rails/rails/releases/tag/v8.0.5.1](https://github.com/rails/rails/releases/tag/v8.0.5.1)
- [https://github.com/rails/rails/releases/tag/v8.1.3.1](https://github.com/rails/rails/releases/tag/v8.1.3.1)
- [https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm](https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm)

## Related threats

- [Active Storage: Possible local file disclosure in video previews and analysis](https://junglewise.ai/threats/cve-2026-126188-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Ruby on Rails Active Storage arbitrary file read and RCE in media processing](https://junglewise.ai/threats/cve-2026-126186-active-storage-possible-arbitrary-file-read-and-remote-code)
- [Ruby on Rails Active Storage content length bypass in Google Cloud Storage uploads](https://junglewise.ai/threats/cve-2026-126085-active-storage-possible-circumvention-of-file-size-limits-in)
- [Ruby on Rails Active Storage GCS signature bypass](https://junglewise.ai/threats/cve-2026-126084-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Rails Active Storage persistent DoS via NUL byte filename](https://junglewise.ai/threats/cve-2026-126074-active-storage-makes-it-simple-to-upload-and-reference-files-in)