A Critical Vulnerability in Ruby on Rails Puts Web Applications at Risk
In a potentially disastrous security breach, Ruby on Rails has issued patches for a critical vulnerability that could allow unauthenticated attackers to execute malicious code on web servers. The issue affects applications built using the popular framework’s Active Storage feature and exposes sensitive information such as secret keys and credentials.
The vulnerability, tracked as CVE-2026-66066, is an arbitrary file read that can be exploited by uploading a crafted file to a Rails application that uses the libvips library for image processing. This allows attackers to access and potentially steal sensitive data from the server’s environment, including secret keys and external system credentials.
In its default configuration, a Rails application displays image variants, which may allow an unauthenticated attacker to read arbitrary files from the server. The advisory notes that this could include secret_key_base and credentials for external systems, giving attackers a foothold to escalate their attack to remote code execution (RCE).
The issue impacts applications that use Active Storage for image uploads from untrusted users and have not disabled “unfuzzed” operations, which are marked as unsafe for untrusted content. Libvips is responsible for marking file read and write operations as unfuzzed, but Active Storage did not disable these operations, leaving a security gap.
Ruby on Rails has patched the vulnerability in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 of Active Storage. Users are advised to update their deployments as soon as possible and also upgrade libvips to at least version 8.13, which supports disabling unfuzzed operations.
The good news is that there is no evidence yet that the vulnerability has been exploited in the wild, according to cybersecurity firm Rapid7. However, this does not mean that affected applications are safe – attackers may still be planning an attack or have already compromised sensitive data.
To protect against this vulnerability, it’s essential for Rails developers and administrators to update their applications immediately. Even if the vulnerability is patched, there is a risk of sensitive data being exfiltrated, so it’s crucial to treat every secret readable by the application process as potentially exposed and change it.
This is a stark reminder that web application security requires constant vigilance and attention to detail. As we continue to rely on complex software frameworks like Ruby on Rails, we must also prioritize security updates and patching to prevent such vulnerabilities from being exploited.
Source: SecurityWeek — 2026-08-01