A critical flaw in Rails Active Storage, tracked as CVE-2026-66066, can let an unauthenticated attacker read arbitrary files and potentially achieve remote code execution when libvips is used. Rails maintainers and Akamai warn that affected systems should be upgraded quickly, secrets rotated, and temporary protections applied where possible. #CVE-2026-66066 #ActiveStorage #Rails #libvips #secret_key_base #Akamai #Ethiack #GMOFlattSecurity
Keypoints
- CVE-2026-66066 is a critical vulnerability in Rails Active Storage.
- An attacker can read arbitrary files from a vulnerable Rails application.
- The exploit is triggered when libvips processes specially crafted image uploads.
- Successful exploitation may expose secret_key_base and other sensitive credentials.
- Rails urges upgrades, secret rotation, and temporary libvips protections where available.