Heads up, Rails devs: a nasty Active Storage bug can let a stranger upload a crafted image and read files from your server. Tracked as CVE-2026-66066, this one scores a scary 9.5 and can leak secrets the Rails process can read — things like secret_key_base, master keys, DB credentials and cloud tokens. In plain English: if an attacker can upload images, they might be able to peek into your app’s secrets cupboard and cause real trouble.

What’s the problem?

Active Storage uses an image library called libvips for processing. Some libvips operations are flagged as “untrusted” because they rely on third-party loaders or handlers that aren’t safe with hostile input. Active Storage used to hand untrusted uploads straight to those risky operations, allowing a crafted image to trigger a loader that reads files the Rails process can access.

That means a successful exploit gives an attacker an arbitrary file-read ability. What happens next depends on what they find: stolen credentials can lead to remote code execution or lateral moves into other systems the app talks to.

  • Affected stacks include Rails builds that use libvips with Active Storage enabled. Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5, and 8.1.0–8.1.3 are in the risky ranges reported. Rails 6.0.x and 6.1.x are vulnerable only if configured to use Vips (it wasn’t the default there).
  • MiniMagick users are not exposed via this specific attack path.
  • Rails 7.0 and 7.1 are end-of-life and do not have fixes; apps on those branches need to upgrade to a patched release on a supported branch.

What you should do right now

Don’t panic, but move fast. The safest route is to upgrade Rails and dependencies, then rotate any credentials that the application process could read.

  • Upgrade Rails to a patched release: 7.2.3.2, 8.0.5.1, or 8.1.3.1 (or later).
  • Ensure libvips is version 8.13 or newer. If you use the ruby-vips bindings, get ruby-vips 2.2.1 or later.
  • If you can’t update Rails immediately and you have libvips 8.13+, set the environment variable VIPS_BLOCK_UNTRUSTED or call Vips.block_untrusted(true) to block unsafe operations.
  • Rotate anything the Rails process can read — rotate secrets: secret keys, master keys, DB passwords, Active Storage service keys, and third-party tokens.
  • Audit logs and uploads for suspicious activity if you accept untrusted image uploads.

There wasn’t a public proof-of-concept available as of late July 2026, and the researchers have delayed full technical details until later (with public disclosure deadlines set by the parties involved). That said, the patch itself does not invalidate credentials that may already be stolen, so rotating secrets is critical.

Credit for reporting goes to the independent security researchers who responsibly disclosed the issue. Keep an eye on your dependency versions, and treat untrusted uploads like radioactive jelly — beautiful, useful, and potentially hazardous if you forget basic containment.