Critical Rails Flaw Lets Unauthenticated Attackers Read Server Files and Execute Code

A critical vulnerability in Ruby on Rails’ Active Storage component could allow unauthenticated attackers to read arbitrary files on vulnerable application servers, potentially escalating to remote code execution.

This vulnerability is tracked as CVE-2026-66066 and affects Active Storage variant processing in Rails applications configured to use libvips for image manipulation.

Rails maintainers disclosed the issue on July 29, 2026, warning that deployments accepting image uploads from untrusted users are at the highest risk.

Technical details regarding the attack have been intentionally withheld until August 28, 2026, to minimize the risk of widespread exploitation before administrators can patch affected systems.

Critical Rails Flaw

The vulnerability arises from Active Storage’s interaction with libvips. This image-processing library handles multiple file formats through loaders, savers, and other operations.

Third-party libraries support some of these operations. They are classified by libvips as “unfuzzed,” meaning they are unsafe to invoke with content controlled by an attacker.

Previously, Active Storage did not block these unsafe operations, allowing a maliciously crafted upload to trigger one during variant processing. Researchers have shown a method that can disclose files accessible to the targeted Rails application process.

The exposed files may include the process environment, creating a particularly severe downstream risk. In many Rails deployments, environment variables contain the application’s secret_key_base, cloud storage access keys, database credentials, third-party API tokens, and deployment secrets.

If an attacker gains access to the secret_key_base, they could forge signed data or compromise session security. Similarly, leaked service credentials could grant access to cloud resources, databases, or external platforms.

Rails warns that the initial arbitrary file-read vulnerability could facilitate remote code execution, lateral movement, or broader infrastructure compromise, depending on the secrets available to the application.

Applications are affected if they use libvips with the configuration setting `config.active_storage.variant_processor = :vips`, permit untrusted image uploads, and are running vulnerable Active Storage versions.

The libvips processor became the default for applications using Rails load_defaults 7.0, making this issue relevant to a wide range of modern Rails environments.

Vulnerable versions include Active Storage releases earlier than 7.2.3, from 8.0.0 through 8.0.4, and from 8.1.0 through 8.1.2. Administrators should inventory exposed upload endpoints and immediately verify both their Active Storage and system libvips versions.

Rails has released patched versions of Active Storage and requires libvips version 8.13.8 or newer for secure operation. Earlier versions of libvips cannot turn off unsafe operations, and the patched Active Storage will fail to start if it detects an unsecure version.

Organizations unable to upgrade Rails immediately can set the VIPS_BLOCK_UNTRUSTED environment variable when using libvips 8.13.8 or later.

Deployments using ruby-vips 2.12.2 or newer can alternatively invoke `Vips.block_untrusted(true)` from an initializer. Systems running older versions of libvips have no safe workaround other than removing the dependency.

Patching alone does not invalidate secrets that may have already been compromised. Rails recommends treating every secret read by the application process as potentially exposed and advises rotating the secret_key_base, Rails master key, encrypted credentials, cloud storage keys, database passwords, and third-party service tokens.

Changing the secret_key_base will invalidate active sessions, signed cookies, signed Global IDs, and Active Storage URLs, requiring users to authenticate again. Researchers from Ethiack and GMO Flatt Security responsibly reported the vulnerability.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.