CVE-2026-66066

Think of Active Storage like your app’s “photo editor pipeline.” This issue means a specially made photo might trick the editor into touching files it shouldn’t. If the attacker can read secrets (like app keys), they may use those secrets to take over the app or move deeper into your systems.

This matters if you run a Rails app that accepts image uploads from untrusted users and processes those uploads through Active Storage variant processing using libvips. If your app doesn’t use that image-processing path, exposure is less likely. Also, the danger is only relevant when an attacker can reach the upload feature (i.e., the upload endpoint is reachable from the internet and the app accepts user-controlled images).

This is RED because exploitation has been tied to active malicious activity (Laundry Bear), and the issue directly involves a public-facing capability: malicious image uploads being processed by your app. Even with no public exploit code on record, the combination of real-world actor attention and the ability to read sensitive files makes it a priority to address now.