Ruby on Rails released security fixes for a critical bug that can let an unauthenticated attacker read files from vulnerable servers and potentially take over affected applications. The flaw, CVE-2026-66066, affects Rails apps using Active Storage with libvips for image processing and accepting untrusted image uploads. Patched versions are Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1, and maintainers also advise updating libvips to at least 8.13.
Why it matters: Organizations running Rails apps that process user-uploaded images should update quickly, because stolen secrets may allow full application compromise or lateral movement. Patching alone may not be enough if exposure already happened, so affected teams should also rotate secrets readable by the app process.
Bill Toulas
2026.08.01
98% relevant
This article covers the same Rails Active Storage vulnerability, CVE-2026-66066, and adds operational detail on affected versions, the libvips-specific attack path, mitigations like VIPS_BLOCK_UNTRUSTED and secret rotation, and the note that public PoC details appeared quickly, prompting full disclosure and forensic tooling.
Ionut Arghire
2026.08.01
100% relevant
This article establishes a new tracked story around CVE-2026-66066, a newly disclosed and patched critical Ruby on Rails vulnerability with clear affected versions, attack conditions, and remediation steps.
← Back to all stories