Rails Patches Critical Active Storage Vulnerability

Recently, Rails announced patches for a critical vulnerability in the Active Storage framework, which could allow unauthenticated attackers to read arbitrary files from a Rails application and potentially escalate to remote code execution (RCE). The vulnerability, tracked as CVE-2026-66066, has been rated as critical severity by the Rails maintainers. This flaw is exploitable when the libvips library is used for image processing, allowing an attacker to upload a specially crafted image file to a vulnerable application and read arbitrary files on the server, including the process environment that typically contains sensitive information such as 'secret_key_base' and database credentials. The Rails team recommends upgrading to libvips version 8.13 or later and rotating any secrets that may have been exposed. The vulnerability affects Active Storage versions prior to 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. While there is currently no evidence that this vulnerability has been exploited in the wild, security experts caution that attackers may utilize AI tools to reconstruct the attack chain based on the patch details.