Unauthenticated Image Upload Bug in Rails Enables Arbitrary File Reading

Key Takeaways

• A critical file‑read vulnerability (CVE‑2026-66066, CVSS 9.5) affects Ruby on Rails applications that use libvips for Active Storage image processing.
• Unauthenticated attackers can craft image uploads to read arbitrary files from the server, potentially exposing secrets such as secret_key_base, master key, database passwords, cloud credentials, and API tokens.
• Affected Rails versions include 7.0.0‑7.2.3.1, 8.0.0‑8.0.5, and 8.1.0‑8.1.3; Rails 6.x is vulnerable only when libvips is explicitly configured as the processor.
• The fix is available in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1; operators must also upgrade libvips to ≥ 8.13 (or ruby‑vips ≥ 2.2.1) and rotate all exposed secrets.
• No public proof‑of‑concept exploit was available at disclosure, and the vulnerability had not yet appeared in CISA’s Known Exploited Vulnerabilities catalog.
• Researchers from Ethiack and GMO Flatt Security independently reported the issue; further technical details are scheduled for release by August 28, 2026.

Overview of CVE‑2026-66066
CVE‑2026-66066 is a high‑severity flaw discovered in the Active Storage component of Ruby on Rails. The vulnerability stems from how Active Storage hands off uploaded image data to the libvips image‑processing library without sufficient validation. Libvips includes a set of loaders, savers, and other operations that are marked “unfuzzed” or “untrusted” because they can be abused with malicious input. By crafting a specially formatted image file, an attacker can trigger one of these unsafe operations, causing libvips to read arbitrary files accessible to the Rails process. The vulnerability does not require a dedicated resize or thumbnail endpoint; any Active Storage upload that passes through libvips is sufficient for exploitation.

Impact and Potential Consequences
When successfully exploited, the flaw grants the attacker an arbitrary file‑read primitive on the server. This enables the extraction of sensitive data stored in files readable by the Rails worker process, such as the application’s secret_key_base, the master encryption key, database connection strings, cloud‑storage access keys, and third‑party API tokens. Possession of these secrets can facilitate further attacks, including remote code execution (RCE) by signing malicious session cookies, decrypting encrypted credentials, or moving laterally into internal services that trust the compromised credentials. The CVSS score of 9.5 reflects both the high impact (confidentiality breach) and the low attack complexity (no authentication required).

Affected Rails Versions
The vulnerability affects a broad range of Rails releases. According to the disclosures from Ethiack and GMO Flatt Security, the following ranges are vulnerable:

• Rails 7.0.0 through 7.2.3.1
• Rails 8.0.0 through 8.0.5
• Rails 8.1.0 through 8.1.3

Rails 6.x (6.0.0‑6.1.7.10) is only impacted when Active Storage is explicitly configured to use libvips as its image processor, which was not the default in those versions. Applications that rely on the alternative MiniMagick processor are not exposed via this specific attack path. Notably, Rails 7.0 and 7.1 have reached end‑of‑life and will not receive patched releases; users on those branches must upgrade to a supported version (7.2.3.2 or later) to mitigate the risk.

Patched Versions and Upgrade Guidance
The Rails security team has issued fixes in the following releases:

• Rails 7.2.3.2
• Rails 8.0.5.1
• Rails 8.1.3.1

Upgrading to one of these versions resolves the core issue. However, the patch also depends on the underlying libvips library. Administrators must ensure that libvips is at least version 8.13; if the ruby‑vips gem is used, it should be version 2.2.1 or newer. For environments that cannot immediately upgrade Rails, a temporary workaround is available: setting the environment variable VIPS_BLOCK_UNTRUSTED=true when starting the application, or invoking Vips.block_untrusted(true) at boot with ruby‑vips ≥ 2.2.1. Older libvips releases lack the ability to block untrusted operations, so in those cases the only reliable remedy is to upgrade libvips or remove it from the stack entirely.

Mitigation Steps Beyond Patching
Applying the patch alone does not invalidate any credentials that may have already been exfiltrated. Therefore, organizations should treat the exposure as a breach and rotate every secret that the Rails process could read. This includes:

• secret_key_base and the Rails master key
• Database usernames and passwords
• Cloud service access keys (e.g., AWS S3, Google Cloud Storage)
• Active Storage service credentials
• Any third‑party API tokens stored in configuration files or environment variables

Additionally, reviewing logs for unusual image‑upload patterns, restricting upload endpoints to trusted users where possible, and enforcing strict file‑type validation can reduce the attack surface while upgrades are being rolled out.

Technical Root Cause
The vulnerability resides at the trust boundary between Active Storage and libvips. Libvips provides a rich set of operations, some of which rely on third‑party libraries that have not been subjected to fuzz testing. These operations are labeled “unfuzzed” or “untrusted” because they can behave dangerously when supplied with malicious data. Active Storage, by default, passes the raw upload data to libvips without filtering out unsafe operations. Consequently, a crafted image can invoke a loader or saver that reads arbitrary files from the filesystem, leaking their contents back to the attacker through the upload response. The patch mitigates this by calling Vips.block_untrusted(true) at startup, which disables those dangerous operations for the duration of the process.

Disclosure and Credit
The issue was discovered independently by two research groups: André Baptista, Bruno Mendes, and Rafael Castilho of Ethiack, and RyotaK of GMO Flatt Security. Both teams reported the findings to the Rails security team, which coordinated the release of the patches and the accompanying advisory. As of the publication date (July 29, 2026), no public proof‑of‑concept exploit or detailed attack chain had been released. The researchers have indicated that further technical details—including the malicious file format, the exact file‑read construction, and any potential RCE chain—will be disclosed no later than August 28, 2026, allowing defenders time to apply mitigations.

Exploitation Status and Observations
At the time of the advisory, there were no reports of in‑the‑wild exploitation, and CVE‑2026-66066 had not appeared in version 2026.07.27 of CISA’s Known Exploited Vulnerabilities catalog. Searches of public exploit repositories (GitHub, GitLab, Exploit‑DB, Packet Storm) yielded no matching code. Nevertheless, the high CVSS score and the relative ease of triggering the flaw with a crafted image upload mean that the vulnerability remains a significant threat until mitigated. Organizations are advised to treat the issue as actively exploitable and prioritize patching and credential rotation accordingly.

Scope of Affected Deployments
While the CVSS score reflects the intrinsic severity of the flaw, the actual number of vulnerable installations depends on several conditions: the application must be using libvips (directly or via ruby‑vips), accept image uploads from untrusted sources, and have a libvips build that includes the vulnerable, untrusted operations. Deployments that have switched to MiniMagick or that restrict uploads to authenticated users only are not at risk via this specific vector. Nonetheless, given the widespread use of Active Storage for handling user‑provided images in Rails applications, a substantial portion of the Rails ecosystem is potentially affected until the recommended upgrades are applied.