Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has issued patches for a high-severity vulnerability in Active Storage that allows unauthenticated attackers to read arbitrary server files through specially crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw could expose sensitive data like encryption keys, database credentials, and API tokens, potentially leading to remote code execution or lateral movement. The issue affects applications using libvips for image processing and accepting untrusted uploads. Affected versions include Rails 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3. Operators are advised to upgrade to 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate all exposed secrets. As of now, no proof-of-concept or real-world exploitation has been observed.