Rails Active Storage RCE Vulnerability: Unauthenticated File Read and Potential Code Execution

CVE-2026-66066 is a critical Active Storage vulnerability that can allow an unauthenticated attacker to read arbitrary files from a Rails server through a specially crafted image. Exploitation requires an application that accepts image uploads from untrusted users and processes them with a vulnerable version of libvips. ImageMagick users are not affected by this vector, and Rails 6.x is affected only where Active Storage has been configured outside its defaults.

The direct primitive is file disclosure, not storage of executable code. Attackers may read the application process environment and recover secret_key_base alongside database, cloud-storage and other credentials. Possession of secret_key_base can allow an attacker to forge signed session cookies, sign Global IDs and manipulate serialised data; in a susceptible Rails application, those capabilities can form a chain to remote code execution.

The RCE outcome is therefore potential and configuration-dependent rather than an automatic result of any Active Storage deployment. Exposure is highest where public, user-controlled image uploads reach vulnerable libvips processing. Affected Active Storage versions are before 7.2.3.2, 8.0.x before 8.0.5.1 and 8.1.x before 8.1.3.1.

Rails recommends upgrading to fixed framework releases and libvips 8.13 or later, then rotating secret_key_base, database credentials, Active Storage service credentials and other secrets accessible to the application process. Systems on libvips 8.13 or later can temporarily block the vulnerable functionality with VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true) when using ruby-vips 2.2.1 or newer. No workaround is available for applications using libvips before 8.13.