Critical Alert on Rails Active Storage exposes secrets and allows you to read arbitrary files

A critical vulnerability in Ruby on Rails's Active Storage, registered as CVE-2026-66066 (CVSS 9.5), allows an unauthenticated attacker to read arbitrary files from the application server through manipulated image loads. The root of the failure is not Rails itself, but the interaction between Active Storage and the libvips image processing library: Active Storage passed unreliable content to libvips operations marked "untrusted" or "unfuzzy," which can invoke unsafe chargers and salvers capable of returning any files accessible by the Rails process.

The practical scenario that turns that access into a serious intrusion is the exposure of secrets in the environment of the Rails process: secret _ key _ base, key master of Rails, decrypt credentials, database passwords, storage services keys and APIs tokens. With these credentials an attacker could perform remote code (CERs) execution on connected services, move laterally within the infrastructure or empty sensitive data in cloud services. The operation also requires that the application use libvips for image processing and accept loads from unreliable users; applications using MiniMagick are not affected by this specific route.

The affected branches and versions identified by the research teams are Rails 7.0.0 to 7.2.3.1, Rails 8.0.0 to 8.0.5 and Rails 8.1.0 to 8.1.3, and Rails 6.0.0 to 6.1.x only when Active Storage is configured to use Vips (in Rails 6 Vips it was not the default processor). Rails has published patches and recommended versions to update are 7.2.3.2, 8.0.5.1 and 8.1.3.1. In addition, the parcheed facilities require libvips 8.13 or higher and, if you use ruby-vips, version 2.2.1 or later. You can check the launch notes and project activity in the official Rails repository and in the ruby-vips and libvips resources to confirm versions and patches: https: / / github.com / rails / rails / releases and https: / / github.com / libvips / ruby-vips.

For operators who cannot apply the Rails patch immediately there is a temporary mitigation: to enable the blocking of unreliable libvips operations. If your environment has libvips 8.13 or higher you can export the environment variable VIPS _ BLOCK _ UNTRUSTED = true or to invoke programmatically Vips.block _ untrusted (true) from ruby-vips 2.2.1 or later. If your installation uses an earlier version of libvips without that capacity, the only safe alternative is to update libvips or stop using Vips for Active Storage until you can park Rails and the underlying library.

It is essential to understand that applying the patch does not invalidate credentials that have already been exposed. Rails explicitly warns that, after patching, all the secrets that the Rails process can read must be rotated. At least, this includes secret _ key _ base, key master and unencrypted credentials, database passwords, Active Storage service keys (S3 / GS / etc.) and third-party tokens. The rotation must be accompanied by audit and verification: seek unusual access, requests to endpoints that accept images, unexpected data transfers and creation of new accounts or keys in linked systems.

In parallel to rotation, response teams should capture and analyse logs related to load and image processing, review snapshots and backups by suspicious activity, and check the integrity of images and execution vectors. If there are suspicions of exfiltration or prior commitment, treat the incidence as a complete intrusion: isolate committed services, replace credentials in all dependent systems, and consider forensic audits. Since a public PoC has not yet been published and holdings in nature have not been confirmed at the time of the notice, the commitment indicators may be limited; however, the possibility of reading remote files makes any sign of abnormal access a matter of priority.

From an in-depth architecture and defense perspective, it is appropriate to take measures to reduce the impact of similar failures in the future: minimize the reading surface of the Rails process (running it with the least set of necessary permissions), segment service credentials with limited access roles and policies, limit the types and file sizes that it accepts Active Storage and apply validation of content on the server side before passing files to native processors. It is also recommended to implement alerts for foreign Active Storage operations and keep an inventory of native dependencies such as libvips outside the Ruby package cycle to be able to park them separately.

The discoverers of the ruling were accredited by Rails as researchers of Ethiack and GMO Flatt Security. Rails has indicated that it will provide additional technical details no later than 28 August 2026, when more detection techniques and finer descriptions of the attack vector are likely to arrive. Until then, the priority recommendation is to park fast, update libvips and ruby-vips where appropriate, and rotate all the keys and secrets legible by the Rails process.

Finally, remember that the CVSS score 9.5 reflects technical severity, not mass exposure: to be exploitable the application must use Vips to process images, accept unreliable user loads and have a libvips build that includes unsafe operations. However, if your service meets these requirements, treat this vulnerability as an operational emergency and proceed with the recommended updates and rotations with the utmost urgency.