Ruby on Rails has released urgent patches to address a critical vulnerability that could allow unauthenticated attackers to perform remote code execution. The flaw, identified as CVE-2026-66066 with a CVSS score of 9.5, is described as an arbitrary file read issue. This can expose sensitive information and potentially enable attackers to execute code or navigate laterally across systems. The vulnerability affects applications utilizing the libvips library for Active Storage image processing, particularly where image uploads from untrusted users are allowed.
The problem arises because libvips marks certain file operations as unsafe for untrusted content, and Active Storage did not disable these risky operations. Consequently, an attacker could exploit this by uploading a specifically crafted file to read arbitrary files from the server. These files could contain sensitive information such as secret keys and credentials, which could be used to escalate the attack.
The Ruby on Rails team has patched this vulnerability in Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Users are strongly encouraged to update their systems promptly and also upgrade libvips to version 8.13 or beyond, as previous versions do not support disabling unsafe operations. While the patch addresses the vulnerability, it does not reverse any exposure of secrets that might have already occurred. Thus, affected applications should treat any exposed secrets as compromised and replace them. As of now, there is no evidence that this vulnerability has been exploited in the wild, according to cybersecurity firm Rapid7.