Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.

Tracked asCVE-2026-66066(CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such assecret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. Those secrets may enable remote code execution (RCE) or lateral movement into connected systems.

Affected applications use libvips for Active Storage image processing and accept image uploads from untrusted users. Rails selects Vips underload_defaults 7.0, and later defaults retain it.

Ethiack and GMO Flatt Security list the affected ranges as Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. Rails 6.0.0 through 6.1.7.10 releases are affected only when Active Storage is configured to use Vips, which was not the default processor in Rails 6.

The Rails Security Team told The Hacker News that the researchers' affected range is accurate. It said the public advisory covers Rails releases under security support, meaning Rails 7.2, 8.0, and 8.1, while Rails 6.x is also affected when Vips is enabled, which was not the default at the time. Applications using MiniMagick are not exposed through this specific attack path. Rails 7.1 and earlier are end of life and will receive no backport, so affected applications must upgrade to Rails 7.2.3.2 or later.

Operators should upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate every secret readable by the application process. Patched installations require libvips 8.13 or later and, when ruby-vips is installed, ruby-vips 2.2.1 or later.

Neither research team had published a proof-of-concept (PoC) as of 17:30 UTC on July 29, 2026. A third-partyGitHub repositorypublished after that check claims to reproduce the full arbitrary-file-read-to-RCE chain in a loopback-only Docker lab using Rails 8.1.3, with Rails 8.1.3.1 as the patched control. The code uses a crafted MATLAB/HDF5 upload to read the Rails process environment, recoverSECRET_KEY_BASE, sign an embedded Marshal payload, and trigger an out-of-bandcurlcallback. The Hacker News has not independently validated the PoC.

The flaw sits at the trust boundary between Active Storage and libvips. TheRails security advisorysays libvips supports loaders, savers, and other operations, some backed by third-party libraries and marked "unfuzzed" or "untrusted" because they are unsafe for hostile input. Active Storage did not block them, allowing a crafted upload to invoke one and disclose files readable by the Rails worker.

A vulnerable application does not need to expose a dedicated resize or thumbnail operation. "Generating variants is not a separate requirement," Rails said. Thepublic patchalso shows that both the Vips analyzer and transformer passed untrusted attachments to the unsafe operations.

A successful request gives the attacker an arbitrary file-read primitive. Code execution or lateral movement would depend on what the attacker extracts and what those credentials can reach. Rails tells operators to rotatesecret_key_base, the master key and decrypted credentials, database credentials, Active Storage service keys, and third-party tokens.

The patch callsVips.block_untrusted(true)when Active Storage starts. Applications that cannot immediately update Rails can setVIPS_BLOCK_UNTRUSTEDwhen running libvips 8.13 or later, or callVips.block_untrusted(true)with ruby-vips 2.2.1 or later. Rails says earlier libvips versions cannot block these operations, so applications must upgrade libvips or remove it from the application.

Rails credited André Baptista, Bruno Mendes, and Rafael Castilho ofEthiack, and RyotaK ofGMO Flatt Security, with independently reporting the issue. The researchers have not disclosed the malicious format, file-read construction, or RCE chain. Rails said further technical details will be released no later than August 28, 2026.

The Rails Security Team told The Hacker News that it is not aware of exploitation or attempted exploitation before or after disclosure. It also said Rails has no telemetry or reasonable estimate for how many applications use Active Storage with Vips and accept untrusted image uploads. The Hacker News has also contacted Ethiack about the attack chain and will update this story with any response.

A review by The Hacker News at 17:30 UTC on July 29 found thatCVE-2026-66066was not listed in version 2026.07.27 of CISA'sKnown Exploited Vulnerabilities catalog.

No reliable count of vulnerable applications or named victims is available. The 9.5 score describes severity under CVSS, not how many deployments are exposed: a vulnerable deployment must also use Vips, accept untrusted image uploads, and include an exploitable operation in its libvips build.

Update [July 30, 2026]:This story has been updated to include comments from the Rails Security Team and details about a newly published third-party proof-of-concept.

Cybersecurity Webinars

How to Secure AI Code Before It Reaches Production

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

How to Secure AI-Built Software at Machine Speed

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

A Look Inside Lasso's AI Security Platform

Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One.

How to Make Social Engineering Unprofitable

The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent

Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.