Ruby on Rails has fixed CVE-2026-66066, a critical Active Storage flaw that could let unauthenticated attackers read arbitrary files through crafted image uploads when libvips is used. The issue can expose secrets like secret_key_base, database credentials, and API tokens, potentially enabling RCE or lateral movement if operators do not upgrade and rotate credentials. #Rails #CVE-2026-66066 #ActiveStorage #libvips #Ethiack #GMOFlattSecurity
Keypoints
- CVE-2026-66066 lets unauthenticated attackers read arbitrary files from Rails servers.
- The flaw affects Active Storage installations that use libvips for image processing.
- Exposed secrets may include secret_key_base, master keys, database passwords, and API tokens.
- Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 contain the fixes.
- Operators should upgrade libvips and rotate all secrets that the application can access.
Read More: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html