Rails Active Storage: file read, possible code execution flaw (CVE-2026-66066) fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1
Published 01/11/2026 02:04
Timeline
2 events over 2 d 1 h
- 30/10/2026ConfirmedCERT-FR advisories+2 d 1 h
- 01/11/2026 02:04Published on WatchtowerPro CISO
In short
A flaw in Ruby on Rails Active Storage with libvips lets an unauthenticated attacker read any file the Rails process can read, including secrets. Leaked secrets can lead to remote code execution. The Rails project has released fixes, and public proof-of-concept code exists.
How bad is it
Critical. An attacker who can upload an image to a vulnerable Rails app can read files and secrets on the server, which can lead to running their own code, without logging in.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 4.0 from NVD, from github.com, read 01/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: information disclosure.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- activestorage before 7.2.3.2, 8.0.x before 8.0.5.1 and 8.1.x before 8.1.3.1
- Apps are affected only if they use libvips for Active Storage (config.active_storage.variant_processor = :vips) and accept image uploads from untrusted users
Fixed in
- 7.2 branch: 7.2.3.2
- 8.0 branch: 8.0.5.1
- 8.1 branch: 8.1.3.1
What to do now
- Upgrade activestorage (Rails) to the fixed version for your line: 7.2.3.2, 8.0.5.1 or 8.1.3.1.
- Use libvips 8.13 or newer and ruby-vips 2.2.1 or newer. With older versions, patched Active Storage raises an error at boot.
- If you cannot upgrade yet, remove ruby-vips from the Gemfile if it is used only for image analysis or the app does not use Active Storage. This reduces exposure but does not make the server safe.
- Rotate secret_key_base and every secret reachable from the app environment on any app that was vulnerable and accepted uploads.
- Test image handling after the update. The patch blocks libvips loaders and savers that are unsafe for untrusted files, such as FITS and JXL, so some image types may no longer produce variants.
- The Rails project has published a forensics repository (rails/rails-forensics-CVE-2026-66066) for checking whether an app was hit.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run Ruby on Rails trilogy, at which version, fixed or not - and what each one needs.
Main sources
Vulnérabilité dans Ruby on Rails trilogy (30 octobre 2026) CERT · [UPDATE] [kritisch] Ruby on Rails: Schwachstelle ermöglicht Offenlegung von Informationen CERT · CVE-2026-66066 Detail - NVD Research