Full Report
Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,
Analysis Summary
# Vulnerability: Rails Active Storage Arbitrary File Read via libvips
## CVE Details
- **CVE ID:** CVE-2026-66066
- **CVSS Score:** 9.5 (Critical)
- **CWE:** Not specifically listed (likely CWE-73: External Control of File Name or Path, or CWE-611: Improper Restriction of XML External Entity Reference given the image processing context)
## Affected Systems
- **Products:** Ruby on Rails (Active Storage component)
- **Versions:**
- Rails 7.0.0 through 7.2.3.1 (Note: 7.0 and 7.1 are EOL)
- Rails 8.0.0 through 8.0.5
- Rails 8.1.0 through 8.1.3
- Rails 6.0.0 through 6.1.7.10 (Only if manually configured to use `vips`)
- **Configurations:** Systems using **libvips** as the image processing engine and allowing image uploads from untrusted users. (Applications using `MiniMagick` are not affected).
## Vulnerability Description
The flaw resides in the trust boundary between Rails' Active Storage and the `libvips` library. Certain `libvips` operations (loaders/savers) are backed by third-party libraries marked as "untrusted" or "unfuzzed." Active Storage failed to block these unsafe operations, allowing an unauthenticated attacker to upload a crafted image file. When the Rails worker processes the image (via the Vips analyzer or transformer), it can be forced to read arbitrary files from the server's filesystem.
## Exploitation
- **Status:** No known exploitation in the wild; PoC not yet publicly available (as of July 29, 2026).
- **Complexity:** Low to Medium
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** **High** (Exposure of `secret_key_base`, Rails master key, database credentials, cloud storage keys, and API tokens).
- **Integrity:** **High** (Stolen secrets can lead to Remote Code Execution (RCE) or lateral movement).
- **Availability:** **Medium** (Potential for service disruption via RCE).
## Remediation
### Patches
Update to the following Rails versions:
- Rails 7.2.3.2 or later
- Rails 8.0.5.1 or later
- Rails 8.1.3.1 or later
**Dependency Requirements:** Patched versions require **libvips 8.13+** and (if using the gem) **ruby-vips 2.2.1+**.
### Workarounds
1. **Environment Variable:** Set `VIPS_BLOCK_UNTRUSTED=true` (Requires libvips 8.13+).
2. **Manual Configuration:** Call `Vips.block_untrusted(true)` at application startup (Requires ruby-vips 2.2.1+).
3. **Switch Processor:** Change image processor from Vips to `MiniMagick`.
4. **Remove Library:** If libvips cannot be updated to 8.13+, it should be removed from the server.
## Detection
- **Indicators of Compromise:** Review application logs for unusual file access patterns or unexpected image processing errors. Monitor for unauthorized access using credentials stored in `credentials.yml.enc` or environment variables.
- **Post-Exploitation Mitigation:** **Crucial:** Applying the patch does *not* invalidate previously stolen secrets. Administrators **must** rotate the `secret_key_base`, master keys, database passwords, and all third-party API tokens.
## References
- Vendor Advisory: [https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm]
- Patch Commit: [https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5]
- Researcher Analysis (Ethiack): [https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066]
- Researcher Analysis (GMO Flatt Security): [https://blog.flatt.tech/entry/kindarails2shell_rails]