Ruby on Rails has patched CVE-2026-66066, a critical Active Storage flaw that could let unauthenticated attackers read arbitrary files through crafted image uploads and expose sensitive secrets like keys, passwords, and API tokens. Operators should upgrade to the fixed Rails releases immediately and rotate any credentials that may have been exposed, as the issue affects deployments using libvips with untrusted uploads. #RubyOnRails #ActiveStorage #CVE-2026-66066 #libvips #Vips #MiniMagick
Keypoints
- Rails fixed a critical Active Storage vulnerability tracked as CVE-2026-66066.
- The flaw could allow arbitrary file reads via crafted image uploads.
- Exposed secrets may include secret_key_base, the Rails master key, and API tokens.
- Affected versions include Rails 7.0 through 8.1, with Rails 6 impacted only when Vips is enabled.
- Users should upgrade to patched releases and rotate all potentially exposed credentials.
Read More: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html