← Back to Feed

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

CVE-2026-66066

July 29, 2026 · The Hacker News · Severity: CRITICAL

Ruby on Rails released fixes for CVE-2026-66066, a critical Active Storage vulnerability (CVSS 9.5) that allows unauthenticated attackers to read arbitrary server files through crafted image uploads when libvips is used for image processing. The flaw can expose secret_key_base, Rails master key, database passwords, cloud storage credentials, and API tokens, potentially enabling remote code execution or lateral movement. Affected versions include Rails 7.0.0-7.2.3.1, 8.0.0-8.0.5, and 8.1.0-8.1.3. Debian, Ubuntu, and Rails-generated Docker environments are among those vulnerable by default.

Key Takeaways

  • CVE-2026-66066 (CVSS 9.5) in Rails Active Storage enables unauthenticated file disclosure via crafted image uploads when using the libvips processor.
  • Exposed secrets include secret_key_base, database passwords, cloud credentials, and API tokens, which can lead to remote code execution and lateral movement.
  • All Rails versions from 7.0.0 through 8.1.3 using libvips for Active Storage are affected; users should update immediately.
☕ Buy a Coffee