What’s going on?

Rails developers discovered a nasty flaw in Active Storage that, under the right conditions, lets a stranger upload a deceptively crafted image and read files from your app server — and in the worst case, pivot all the way to remote code execution. The bug is tracked as CVE-2026-66066 and is serious because it can leak the app’s master key and other sensitive data.

The exploit chain needs two things: the app must be using libvips to process images, and the server must accept uploads from untrusted users. If both are true, an attacker can craft an image that tricks the image processor into revealing files like configuration, environment variables, and credentials. With access to the Rails master key and other secrets, the attacker can forge sessions and manipulate serialized data — which can turn file reads into full-on execution.

Important notes: ImageMagick-based setups weren’t vulnerable to this vector, but libvips is the default image backend in many official Rails Docker images and common Debian/Ubuntu packages. Rails 7.2/8.0/8.1 releases prior to the fixed versions are affected; Rails 6 is only at risk when Active Storage has been customized away from defaults.

What you should do right now

Short version: patch, check, and maybe change your locks. Here’s a quick, practical checklist you can run through immediately.

  • Patch Rails and libraries: upgrade Active Storage to the patched Rails releases or apply vendor fixes as recommended by the Rails team.
  • Update libvips: move to libvips 8.13 or later if you use libvips for image processing.
  • Temporary mitigation: if you cannot upgrade libvips yet, set the environment variable VIPS_BLOCK_UNTRUSTED=true or call Vips.block_untrusted(true) when using ruby-vips 2.2.1+ to block the risky functionality.
  • Assume compromise and rotate secrets: if you used a vulnerable stack, rotate the secret_key_base, database credentials, storage service keys, and any other secrets the app process can read.
  • Hunt and harden: check logs, use available forensic tools, and add WAF rules — a web application firewall might buy time but isn’t a silver bullet.

If you don’t use libvips or you don’t accept uploads from untrusted users, you’re much less likely to be affected — but it’s still a good time to confirm configurations and dependencies.

Researchers and vendors coordinated disclosure after proof-of-concept exploits appeared publicly, so don’t dawdle: treat this like a hot stove and move fast. Patch, rotate, and verify — and maybe have a coffee while your CI/CD runs the updates.