Critical Ruby On Rails Vulnerability Exposes Sensitive Data

A newly disclosed security vulnerability, tracked as CVE-2026-66066, affects Ruby on Rails’ Active Storage component and could allow attackers to read sensitive files from vulnerable servers. In some cases, the flaw could lead to remote code execution (RCE), making it a serious risk for organizations using affected Rails applications.

The issue impacts applications that use Active Storage with the libvips image-processing library. According to the Rails maintainers, applications that allow image uploads from untrusted users are at the highest risk. To give organizations time to update their systems, technical details of the exploit have been temporarily withheld until August 28, 2026.

How the Vulnerability Works

The flaw is caused by the way Active Storage interacts with the libvips image-processing library during image variant generation. Active Storage failed to block certain unsafe image-processing operations, allowing a specially crafted image upload to trigger unintended behavior.

As a result, an attacker may be able to read files that are accessible to the Rails application. These files can contain valuable information, including:

Application secret_key_base
Database usernames and passwords
Cloud storage access keys
Third-party API tokens
Environment variables and deployment secrets

If attackers obtain these credentials, they could potentially forge application sessions, access cloud resources, compromise databases, or move further inside an organization’s infrastructure.

Affected Versions and Protection

Applications are vulnerable if they:

Use Active Storage with libvips (config.active_storage.variant_processor = :vips)
Accept image uploads from untrusted users
Run affected versions of Active Storage

The vulnerability affects:

Active Storage versions earlier than 7.2.3
Versions 8.0.0 to 8.0.4
Versions 8.1.0 to 8.1.2

Rails has released security updates to fix the issue and recommends using libvips 8.13.8 or later, which blocks unsafe image-processing operations. Organizations that cannot immediately upgrade Rails can enable additional protection by setting the VIPS_BLOCK_UNTRUSTED environment variable when using a supported version of libvips.

Recommended Actions

Organizations should act quickly to reduce the risk of exploitation by:

Updating Rails Active Storage to the latest patched version.
Upgrading libvips to 8.13.8 or newer.
Reviewing applications that accept image uploads.
Rotating sensitive credentials, including database passwords, cloud keys, API tokens, and secret_key_base.
Monitoring systems for suspicious file access or unauthorized activity.

Changing the secret_key_base will invalidate existing user sessions, signed cookies, and Active Storage URLs, requiring users to log in again.

Conclusion

CVE-2026-66066 highlights how vulnerabilities in image-processing components can expose critical application secrets and potentially lead to full server compromise. Organizations using Ruby on Rails should install the latest security updates immediately, review uploaded file handling, and rotate any sensitive credentials that may have been exposed before applying the patch.