Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has fixed CVE-2026-66066, a critical Active Storage flaw that could let unauthenticated attackers read arbitrary files through crafted image uploads when libvips is used. The issue can expose secrets like secret_key_base, database credentials, and API tokens, potentially enabling RCE or lateral movement if operators do not upgrade and rotate credentials. #Rails #CVE-2026-66066 #ActiveStorage #libvips #Ethiack #GMOFlattSecurity

Keypoints

  • CVE-2026-66066 lets unauthenticated attackers read arbitrary files from Rails servers.
  • The flaw affects Active Storage installations that use libvips for image processing.
  • Exposed secrets may include secret_key_base, master keys, database passwords, and API tokens.
  • Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 contain the fixes.
  • Operators should upgrade libvips and rotate all secrets that the application can access.

Read More: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html