Critical Rails Active Storage Flaw Enables Remote Code Execution
A critical vulnerability tracked as CVE-2026-66066 affects the Active Storage component in Ruby on Rails, enabling unauthenticated attackers to read arbitrary files from a server and potentially escalate to remote code execution. The flaw exists when Active Storage uses the libvips image processing library to generate thumbnails from user-uploaded images. By uploading a specially crafted image, an attacker can access sensitive application files, including environment variables that typically contain master keys, database credentials, and cloud storage tokens.
The vulnerability impacts Active Storage versions before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1, with Rails 6.x only affected if configured outside its default settings. Because libvips serves as the default processor in official Rails Docker images as well as Debian and Ubuntu installations, a significant number of deployments are at risk. Applications using ImageMagick instead of libvips are not affected by this specific attack vector.
The Rails team recommends upgrading to libvips 8.13 or later and immediately rotating the secret_key_base along with all database, cloud storage, and service credentials. Systems already running libvips 8.13 or newer can temporarily mitigate the issue by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) in applications using ruby-vips 2.2.1 or above. No workaround exists for older libvips versions, making a full upgrade the only viable path to security.