CVE-2026-66066

Overview

Active Storage is the file attachment framework built into Ruby on Rails. It lets an application upload files to a cloud storage service such as Amazon S3 or Google Cloud Storage, or to a local disk service for development and testing, and attach them to Active Record models, and it can generate resized or reformatted “variants” of image attachments on the fly.

An arbitrary file disclosure vulnerability (CVE-2026-66066) has been identified in Rails’ Active Storage, affecting applications that use the libvips backend (config.active_storage.variant_processor = :vips, the default since Rails 7.0’s load_defaults 7.0) to generate image variants. libvips reads and writes file formats through operations, some of which it marks unsafe for untrusted content, and Active Storage did not disable those unsafe operations. A crafted file upload can invoke one of these operations, causing the server to read and return the contents of an arbitrary file on its filesystem, including the process’s environment variables.

This issue affects Rails applications running Active Storage with the libvips variant processor on any version before 7.2.3.2, and on the 8.0 and 8.1 series before 8.0.5.1 and 8.1.3.1 respectively.

‌

Details

Module Info

• Product: Rails
• Affected packages: activestorage
• Affected versions: < 7.2.3.2; >= 8.0, < 8.0.5.1; >= 8.1, < 8.1.3.1
• GitHub repository: https://github.com/rails/rails
• Published packages: https://rubygems.org/gems/activestorage
• Package manager: RubyGems
• Fixed in: Rails NES (OSS fix: activestorage 7.2.3.2, 8.0.5.1, 8.1.3.1)

Vulnerability Info

This Critical-severity vulnerability is found in the activestorage package, in Rails applications that use libvips to generate Active Storage image variants.

libvips reads and writes image and document formats through backend operations, many implemented by third-party libraries. Because some of those libraries are not safe to run against untrusted input, libvips marks the operations they back as unsafe for untrusted content.

Active Storage did not disable those unsafe operations by default. An unauthenticated attacker who can upload a file through a public form, such as an avatar upload, and cause Active Storage to generate a variant of it can trigger one of these unsafe operations and read the contents of arbitrary files on the server’s filesystem, including environment variables. Because Rails applications commonly store secret_key_base, database credentials, and other secrets in the environment, this can expose the material needed to forge signed data or escalate further; NVD’s write-up for this CVE notes the flaw could potentially enable remote code execution.

Note: This issue only affects applications configured to use the libvips variant processor. Applications using Active Storage’s mini_magick backend are not affected by this specific vulnerability. As an immediate mitigation ahead of upgrading, libvips 8.13 and later can be told to refuse unsafe operations by setting the VIPS_BLOCK_UNTRUSTED=1 environment variable, or by calling Vips.block_untrusted(true) with ruby-vips 2.2.1 or later.

‌

Mitigation

Rails versions before 7.2 (the 5.2, 6.0, 6.1, 7.0, and 7.1 series) are past the end of their maintenance window and will not receive an official patch for this issue. Rails 7.2 itself reached the end of its security-support window on August 9, 2026, immediately after this fix shipped. Rails 8.0 and 8.1 remain in active or security support and already have a patch available.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched release: activestorage 7.2.3.2, 8.0.5.1, or 8.1.3.1.
• Migrate affected applications away from an unsupported Rails version.
• Leverage a commercial support partner like Rails NES for post-EOL security support.