The **Ruby on Rails** development team has released urgent fixes for a severe vulnerability within its **Active Storage** framework. Tracked as **CVE-2026-66066** with a CVSS score of 9.5, this flaw enables unauthenticated attackers to read arbitrary files from application servers through specially crafted image uploads.  ### Impact on Application Secrets A successful exploit of **CVE-2026-66066** could expose critical Rails process environment variables and secrets. This includes `secret_key_base`, the Rails master key, database passwords, cloud storage credentials, and various API tokens. The compromise of these secrets could facilitate remote code execution (RCE) or enable lateral movement within connected systems. ### Affected Configurations Applications are vulnerable if they utilize **libvips** for **Active Storage** image processing and accept image uploads from untrusted sources. **Rails** defaults to **Vips** under `load_defaults 7.0` and subsequent versions. Security researchers from **Ethiack** and **GMO Flatt Security** have identified the affected ranges as **Rails** 7.0.0 through 7.2.3.1, **Rails** 8.0.0 through 8.0.5, and **Rails** 8.1.0 through 8.1.3. **Rails** 6.0.0 through 6.1.7.10 releases are only vulnerable if **Active Storage** is specifically configured to use **Vips**, which was not the default processor in **Rails 6**. ### Patching and Mitigation The **Rails Security Team** confirmed the accuracy of the affected ranges. They noted that the public advisory covers **Rails** releases under security support (**Rails** 7.2, 8.0, and 8.1). **Rails** 7.1 and earlier are End-of-Life (EoL) and will not receive backports, necessitating an upgrade to **Rails** 7.2.3.2 or later for those applications. Operators are strongly advised to upgrade to **Rails** 7.2.3.2, 8.0.5.1, or 8.1.3.1 immediately. Additionally, it is crucial to rotate all secrets potentially readable by the application process. Patched installations require **libvips** 8.13 or later. If **ruby-vips** is installed, version 2.2.1 or later is also necessary. For applications unable to immediately update **Rails**, a temporary mitigation involves setting `VIPS_BLOCK_UNTRUSTED` when running **libvips** 8.13+ or calling `Vips.block_untrusted(true)` with **ruby-vips** 2.2.1+. Earlier **libvips** versions cannot block these operations, requiring either an **libvips** upgrade or its removal from the application. ### Proof-of-Concept Emerges While the reporting research teams had not publicly disclosed a Proof-of-Concept (PoC) by July 29, 2026, a third-party **GitHub repository** later published a PoC claiming to reproduce the full arbitrary-file-read-to-RCE chain. This PoC, tested in a Docker lab, reportedly uses a crafted **MATLAB/HDF5** upload to read the **Rails** process environment, recover `SECRET_KEY_BASE`, sign an embedded **Marshal** payload, and trigger an out-of-band `curl` callback. *Ghost Protocol* has not independently validated this PoC. ### Technical Details of the Flaw The vulnerability resides at the trust boundary between **Active Storage** and **libvips**. The **Rails security advisory** explains that **libvips** supports various operations, some backed by third-party libraries and marked as "unfuzzed" or "untrusted" due to their insecurity against hostile input. **Active Storage** failed to block these operations, allowing a crafted upload to invoke one and disclose files accessible to the **Rails** worker process. Crucially, a vulnerable application does not need to expose a dedicated resize or thumbnail operation; "Generating variants is not a separate requirement," according to **Rails**. The public patch further indicates that both the **Vips** analyzer and transformer passed untrusted attachments to these unsafe operations. ### No Known Exploitation Yet The **Rails Security Team** stated they are not aware of any exploitation attempts before or after disclosure. They also noted a lack of telemetry to estimate how many applications use **Active Storage** with **Vips** and accept untrusted image uploads. As of July 29, 2026, **CVE-2026-66066** was not listed in version 2026.07.27 of **CISA**'s **Known Exploited Vulnerabilities catalog**. While the CVSS score of 9.5 indicates high severity, the actual number of exposed deployments depends on specific configurations, including the use of **Vips**, acceptance of untrusted image uploads, and the presence of an exploitable operation in the **libvips** build.