Ruby on Rails Patches Critical Vulnerability

Ruby on Rails this week rolled out patches for a critical vulnerability that could allow unauthenticated attackers to achieve remote code execution (RCE).

Tracked as CVE-2026-66066 (CVSS score of 9.5), the critical security defect is described as an arbitrary file read that potentially exposes secrets, allowing remote attackers to execute code or move laterally to other systems.

In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. Within the exposed environment, attackers could find secret_key_base and credentials for external systems, which can be abused to escalate to RCE.

The issue impacts applications that use the libvips library for Active Storage image processing and that allow image uploads from untrusted users.

Because libvips marks some file read and write operations as ‘unfuzzed’ (unsafe for untrusted content) and Active Storage did not disable the unfuzzed operations, an attacker could upload a crafted file to invoke one of these operations.

CVE-2026-66066 was patched in Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Users should update deployments ASAP and update libvips to at least version 8.13 (earlier releases do not support disabling unfuzzed operations).

Upgrading closes the vulnerability but does not undo an exfiltrated secret if that already occurred. Affected applications should treat every secret readable by the application process as potentially exposed and rotate them.

According to Rapid7, as of July 30, there is no evidence of exploitation in the wild.