Ruby on Rails this week rolled out patches for a critical vulnerability that could allow unauthenticated attackers to achieve remote code execution (RCE).
A server-side web application framework written in Ruby, Ruby on Rails is used for the fast building of full-stack web applications and APIs.
Tracked as CVE-2026-66066 (CVSS score of 9.5), the critical security defect is described as an arbitrary file read that potentially exposes secrets, allowing remote attackers to execute code or move laterally to other systems.
“In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment,” Ruby on Rails’ maintainers note in an advisory.
Within the exposed environment, the advisory explains, attackers could find secret_key_base and credentials for external systems, which can be abused to escalate the attack to RCE.
The issue impacts applications that use the libvips library for Active Storage image processing and that allow image uploads from untrusted users.
Because libvips marks some file read and write operations as ‘unfuzzed’ (unsafe for untrusted content) and Active Storage did not disable the unfuzzed operations, an attacker could upload a crafted file to invoke one of these operations.
“We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of arbitrary files accessible on the filesystem of the targeted application,” Ruby on Rails’ advisory reads.
CVE-2026-66066 was patched in Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Users are advised to update their deployments as soon as possible, as well as to update libvips to at least version 8.13, as previous library releases do not support disabling unfuzzed operations.
“Upgrading closes the vulnerability but does not undo an exfiltrated secret if that already occurred. An affected application should treat every secret readable by the application process as potentially exposed and change it,” Ruby on Rails notes.
According to cybersecurity firm Rapid7, as of July 30, there is no evidence that the security defect has been exploited in the wild.
Related: Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace
Related: Critical Flaw Led to Azure Cosmos DB Pwnage
Related: Critical Code Execution Vulnerability Patched in TeamCity
Related: ‘DangleGeddon’: AI Could Weaponize Forgotten DNS Records at Global Scale
