Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
A critical Active Storage vulnerability in Ruby on Rails allows unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. The flaw, tracked as CVE-2026-66066, can expose secrets such as secret_key_base, the Rails master key,…
Intelligence analysis by Llama
A critical Active Storage vulnerability in Ruby on Rails allows unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. The flaw, tracked as CVE-2026-66066, can expose secrets such as secret_key_base, the Rails master key, database passwords, and cloud storage credentials.
Imagine you have a file cabinet with many secret documents. A hacker can trick the system into showing them all the documents, even if they're not supposed to see them. This is like a digital version of a file cabinet, and the hacker is trying to get access to all the secret files.
Analysis
A Critical Flaw in Active Storage
A critical Active Storage vulnerability in Ruby on Rails allows unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. The flaw, tracked as CVE-2026-66066, can expose secrets such as secret_key_base, the Rails master key, database passwords, and cloud storage credentials.
The Impact of the Flaw
The flaw sits at the trust boundary between Active Storage and libvips. A successful request gives the attacker an arbitrary file-read primitive. Code execution or lateral movement would depend on what the attacker extracts and what those credentials can reach. Rails tells operators to rotate secret_key_base, the master key and decrypted credentials, database credentials, Active Storage service keys, and third-party tokens.
Patching the Flaw
Rails has released fixes for the flaw, and operators should upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate every secret readable by the application process. Patched installations require libvips 8.13 or later and, when ruby-vips is installed, ruby-vips 2.2.1 or later. Neither research team had published a proof-of-concept (PoC) as of 17:30 UTC on July 29, 2026.
Key points
- A critical Active Storage vulnerability in Ruby on Rails allows unauthenticated attackers to read arbitrary files from application servers through crafted image uploads.
- The flaw, tracked as CVE-2026-66066, can expose secrets such as secret_key_base, the Rails master key, database passwords, and cloud storage credentials.
- Rails has released fixes for the flaw, and operators should upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate every secret readable by the application process.
- Patched installations require libvips 8.13 or later and, when ruby-vips is installed, ruby-vips 2.2.1 or later.
If the patch is applied quickly and all affected applications are upgraded, the risk of exploitation will decrease significantly. This will also give operators time to rotate their secrets and reduce the impact of any potential attacks.
If the patch is not applied quickly, the risk of exploitation will increase, and attackers may be able to steal sensitive information or gain access to connected systems. This could lead to significant financial losses and damage to reputation.
