Ruby on Rails released fixes for CVE-2026-66066, a critical flaw that could let unauthenticated attackers read arbitrary files and potentially reach remote code execution. The issue affects Active Storage with libvips-based image processing and may expose secrets such as secret_key_base, so users should upgrade immediately and rotate any exposed credentials. #RubyonRails #CVE-2026-66066 #ActiveStorage #libvips
Keypoints
- Ruby on Rails patched CVE-2026-66066, a critical vulnerability with a 9.5 CVSS score.
- The flaw can allow unauthenticated attackers to read arbitrary files from affected servers.
- Exposed files may reveal secret_key_base and other credentials needed for further compromise.
- The issue affects Active Storage deployments using libvips for image processing and untrusted uploads.
- Fixes are available in Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1, and libvips should be updated to 8.13 or later.
Read More: https://www.securityweek.com/ruby-on-rails-patches-critical-vulnerability/