Ruby on Rails Patches Critical Active Storage Vulnerability Affecting Image Processing
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-66066 | Unauthenticated Arbitrary File Read in Ruby on Rails Active Storage CVE-2026-66066 is a flaw in Active Storage (part of Ruby on Rails' Action Pack) in which libvips operations that are marked unsafe for untrusted content are not disabled, so a crafted upload can invoke such an operation on the server. It is triggered when an unauthenticated attacker uploads a maliciously crafted image to a Rails application that is configured to use libvips and accepts image uploads from untrusted users. Successful exploitation lets the attacker read arbitrary files accessible to the Rails process, including environment variables and application secrets; leaked credentials such as secret_key_base or external-service tokens can be leveraged for remote code execution or lateral movement. Affected applications are those running Rails 7.2.x, 8.0.x or 8.1.x before the patched releases 7.2.3.2, 8.0.5.1 and 8.1.3.1, provided Active Storage with libvips is in use. Public exploit code is not yet documented, but news reports describe active attacks against Rails apps (a campaign referred to as "KindaRails2Shell"), EPSS assigns a 27.9% probability of exploitation within 30 days (98th percentile), and the flaw is not yet listed in CISA KEV. Do: Upgrade Rails to 7.2.3.2, 8.0.5.1 or 8.1.3.1 depending on your release series. If patching is delayed, restrict or disable libvips processing of untrusted uploads (e.g., limit image variant/preview generation) and review upload and application logs for suspicious image submissions. Treat secrets as potentially compromised on any exposed app: rotate secret_key_base and API/service tokens, and check for signs of follow-on compromise such as forged sessions or unexpected outbound connections. | 9.5 | 28% |
| masson the order of 100,000+ Rails application deployments (order-of-magnitude estimate) |
Full article459 words · extracted from securityaffairs.com · click to collapse
Ruby on Rails fixed a critical vulnerability that could let unauthenticated attackers read files and achieve remote code execution.
Ruby on Rails has patched CVE-2026-66066, a critical vulnerability (CVSS score of 9.5) that could allow unauthenticated attackers to read arbitrary files from vulnerable servers. In the default configuration, applications that generate image variants may expose sensitive data, including environment variables, potentially enabling remote code execution or lateral movement.
“In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment.” reads the advisory. “That environment typically holds secret_key_base and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.”
Organizations should apply the security updates immediately.
The vulnerability affects Ruby on Rails applications using Active Storage with the libvips image processor. libvips relies on several third-party libraries to handle various file formats, including some operations that are marked as unsafe for untrusted files. Because Active Storage did not block these operations, attackers could upload specially crafted images and potentially trigger unintended processing.
“We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application.” continues the advisory. “One specific attack chain has been reported to us (see “Disclosure” below), but we do not assume it is the only one that exists.”
This may allow disclosure of sensitive files stored on the server, including environment variables containing application secrets. Applications are affected when they allow untrusted image uploads and use libvips for variants. The fix is to upgrade Active Storage, update libvips to version 8.13 or later, and rotate exposed secrets such as secret_key_base. Older libvips versions cannot safely disable risky operations.
According to the advisory, patching the Ruby on Rails Active Storage vulnerability is not enough if attackers have already accessed application secrets.
Organizations should consider all secrets handled by the application potentially compromised and rotate them, including secret_key_base, encryption keys, cloud storage credentials, database passwords, and third-party service tokens.
Changing secret_key_base invalidates active sessions, encrypted cookies, signed URLs, and requires users to authenticate again. Exposed secrets should not be kept as backups after rotation. For affected systems using libvips versions older than 8.13, the only mitigation is removing the dependency.
With libvips 8.13 or later, risky “unfuzzed” operations can be disabled through environment settings or ruby-vips configuration. Fixed versions of Active Storage have been released, while technical exploit details will be disclosed later to reduce abuse against unpatched systems.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Ruby on Rails)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/196486/security/ruby-on-rails-patches-critical-active-storage-vulnerability-affecting-image-processing.html