Critical Active Storage flaw exposes files and secrets on Rails servers

On July 29, 2026, Ruby on Rails released fixes for CVE-2026-66066, a critical Active Storage flaw rated 9.5 under CVSS. Crafted image uploads can let unauthenticated attackers read arbitrary files available to the Rails process.

Why the file-read flaw is dangerous

The attack path affects applications that process untrusted image uploads with libvips. Active Storage allowed attachments to reach unsafe libvips operations, including loaders and savers backed by third-party libraries and marked as “unfuzzed” or “untrusted.”

Exposed files may include the Rails environment, secret_key_base, the master key, database passwords, cloud storage credentials and API tokens. File access alone does not guarantee code execution, but stolen credentials could support remote code execution or lateral movement into connected services.

Affected versions and fixes

Ethiack and GMO Flatt Security identified practical exposure in Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5 and 8.1.0–8.1.3. Rails 6.0.0–6.1.7.10 is affected when Active Storage is explicitly configured to use Vips. Applications using MiniMagick are not exposed through this specific route.

Operators should install Rails 7.2.3.2, 8.0.5.1 or 8.1.3.1. Rails 7.0 and 7.1 are end of life, so deployments on those branches must move to 7.2.3.2 or newer. Patched systems also require libvips 8.13 or later and ruby-vips 2.2.1 or later when that gem is installed.

“Generating variants is not a separate requirement,” Rails said.

The patch invokes Vips.block_untrusted(true). As a temporary measure, compatible environments can set VIPS_BLOCK_UNTRUSTED or call the same ruby-vips method. Older libvips releases cannot block the unsafe operations and must be upgraded or removed. No public proof of concept or in-the-wild exploitation had been reported by 17:30 UTC on July 29.

What businesses should do now

Teams should inventory Rails services that accept uploads, verify the image processor and patch the complete dependency chain. Updating is only the first step: rotate every secret readable by the application process, including decrypted credentials, database accounts, storage keys and third-party tokens, because the fix cannot invalidate data that may already have been copied.