Ruby on Rails has launched fixes for a crucial Lively Storage vulnerability that might let unauthenticated attackers learn arbitrary recordsdata from utility servers by crafted picture uploads.
Tracked as CVE-2026-66066 (CVSS rating: 9.5), the flaw can expose the Rails course of atmosphere and secrets and techniques corresponding to secret_key_base, the Rails grasp key, database passwords, cloud storage credentials, and API tokens. These secrets and techniques could allow distant code execution (RCE) or lateral motion into related programs.
Affected purposes use libvips for Lively Storage picture processing and settle for picture uploads from untrusted customers. Rails selects Vips underneath load_defaults 7.0, and later defaults retain it.
Ethiack and GMO Flatt Safety checklist the affected ranges as Rails 7.0.0 by 7.2.3.1, Rails 8.0.0 by 8.0.5, and Rails 8.1.0 by 8.1.3. Rails 6.0.0 by 6.1.7.10 releases are affected solely when Lively Storage is configured to make use of Vips, which was not the default processor in Rails 6.
The official advisory lists a broader package deal vary: activestorage < 7.2.3.2. Each analysis groups place the sensible Vips assault path at Rails 6.0 and later. Purposes utilizing MiniMagick usually are not uncovered by this particular assault path. Rails 7.0 and seven.1 are finish of life and don’t have any fastened releases, so purposes on these branches should improve to Rails 7.2.3.2 or later.
Operators ought to improve to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate each secret readable by the appliance course of. Patched installations require libvips 8.13 or later and, when ruby-vips is put in, ruby-vips 2.2.1 or later.
Neither analysis crew had printed a proof-of-concept (PoC) as of 17:30 UTC on July 29, 2026. Precise-term searches by The Hacker Information discovered no exploit repository in listed GitHub, GitLab, Exploit-DB, or Packet Storm outcomes on the identical time. Rails warned that making use of the patch doesn’t invalidate credentials that will have already got been stolen.
The flaw sits on the belief boundary between Lively Storage and libvips. The Rails safety advisory says libvips helps loaders, savers, and different operations, some backed by third-party libraries and marked “unfuzzed” or “untrusted” as a result of they’re unsafe for hostile enter. Lively Storage didn’t block them, permitting a crafted add to invoke one and disclose recordsdata readable by the Rails employee.
A susceptible utility doesn’t want to reveal a devoted resize or thumbnail operation. “Producing variants will not be a separate requirement,” Rails stated. The general public patch additionally reveals that each the Vips analyzer and transformer handed untrusted attachments to the unsafe operations.
A profitable request offers the attacker an arbitrary file-read primitive. Code execution or lateral motion would rely upon what the attacker extracts and what these credentials can attain. Rails tells operators to rotate secret_key_base, the grasp key and decrypted credentials, database credentials, Lively Storage service keys, and third-party tokens.
The patch calls Vips.block_untrusted(true) when Lively Storage begins. Purposes that can’t instantly replace Rails can set VIPS_BLOCK_UNTRUSTED when operating libvips 8.13 or later, or name Vips.block_untrusted(true) with ruby-vips 2.2.1 or later. Rails says earlier libvips variations can’t block these operations, so purposes should improve libvips or take away it from the appliance.
Rails credited André Baptista, Bruno Mendes, and Rafael Castilho of Ethiack, and RyotaK of GMO Flatt Safety, with independently reporting the problem. The researchers haven’t disclosed the malicious format, file-read building, or RCE chain. Rails stated additional technical particulars shall be launched no later than August 28, 2026.
The Hacker Information has contacted the Rails safety crew about exploitation and affected variations, and Ethiack in regards to the assault chain.
Neither Rails nor the researchers reported in-the-wild exploitation at publication. A assessment by The Hacker Information at 17:30 UTC on July 29 discovered that CVE-2026-66066 was not listed in model 2026.07.27 of CISA’s Recognized Exploited Vulnerabilities catalog.
No dependable rely of susceptible purposes or named victims is on the market. The 9.5 rating describes severity underneath CVSS, not what number of deployments are uncovered: a susceptible deployment should additionally use Vips, settle for untrusted picture uploads, and embrace an exploitable operation in its libvips construct.
