Unauthenticated attackers can access sensitive server files through Ruby on Rails Active Storage flaw
A critical flaw in Ruby on Rails' Active Storage component could allow unauthenticated attackers to read sensitive files from your server. This includes environment variables and secret keys that can lead to remote code execution or lateral movement. Update Active Storage and libvips immediately, then rotate all application secrets. 馃毃
Summary
Ruby on Rails has released urgent patches for a critical vulnerability in its Active Storage component, tracked as CVE-2026-66066. The defect allows unauthenticated attackers to read arbitrary files from the server's filesystem, including the process environment. This exposure can leak secret_key_base and credentials for external systems, providing a path toward remote code execution (RCE) or lateral movement across a network.
The vulnerability specifically impacts applications configured to use the libvips library for image processing and those that accept image uploads from untrusted users. While there is currently no evidence of this flaw being exploited in the wild as of July 30, the severity of the potential impact necessitates immediate remediation.
Technical details
The vulnerability exists because Active Storage does not disable certain "unfuzzed" operations within the libvips library. In libvips, many file read and write operations are marked as unfuzzed, meaning they are unsafe for processing untrusted content.
When an application uses libvips for image variant generation, an attacker can upload a specially crafted file to trigger these unsafe operations. This mechanism allows the attacker to cause the disclosure of arbitrary files accessible to the Rails process. While one specific attack chain has been reported to maintainers, they have not confirmed if other methods exist.
An application meets all criteria for this vulnerability if it:
- Uses
libvipsfor Active Storage image processing (configured viaconfig.active_storage.variant_processor = :vips). - Allows image uploads from untrusted users.
Affected products and fixed versions
| Component | Affected Versions | Fixed Versions |
|---|---|---|
| Active Storage | < 7.2.3.2 | 7.2.3.2 |
| Active Storage | >= 8.0.0.beta1, < 8.0.5.1 | 8.0.5.1 |
| Active Storage | >= 8.1.0.beta1, < 8.1.3.1 | 8.1.3.1 |
Defender guidance
Remediation requires a two-step approach involving both the Rails framework and the underlying libvips library.
1. Update Dependencies
Update Active Storage to one of the fixed versions listed above. Additionally, you must upgrade libvips to at least version 8.13. Previous releases of libvips do not support disabling unfuzzed operations, which is a requirement for the fix.
If you cannot immediately update Rails but can update your system's libvips to version 8.13 or higher, you can mitigate the risk by setting the following environment variable:
VIPS_BLOCK_UNTRUSTED=true
Alternatively, applications running ruby-vips version 2.2.1 or later can call Vips.block_untrusted(true) from an initializer.
2. Rotate All Secrets Upgrading the software closes the hole but does not revoke secrets that may have already been stolen. You must treat every secret readable by the application process as potentially compromised. This includes:
- The
secret_key_base(which expires active sessions and requires users to log in again). - The master key stored in
config/master.keyor supplied viaRAILS_MASTER_KEY. - Everything within
config/credentials.yml.enc. - Credentials for Active Storage services, such as S3, GCS, or Azure keys.
- Tokens and keys used for any third-party service the application calls.
What remains unclear
The specific technical details of the attack chain-how the crafted file interacts with libvips to achieve file disclosure-have been intentionally omitted from the official security advisory to prevent easy exploitation of unpatched systems. Full technical details are scheduled for disclosure on August 28, 2026.
Sources
