CVE-2026-66066: Critical Rails Flaw Exposes Server Files via Image Uploads

Key Takeaways

• Ruby on Rails has released security updates for a critical Active Storage vulnerability that can allow an unauthenticated attacker to read arbitrary f.
• The issue stems from the interaction between Active Storage and libvips, the image-processing library selected by Rails applications using load_defaul.