- The Mess: Attackers are exploiting CVE-2026-66066, a critical Ruby on Rails flaw that can expose arbitrary files through Active Storage when Rails uses the libvips image-processing backend.
- The Damage: A stolen Rails secret can turn a file-read bug into a much bigger compromise, exposing database credentials, API keys and other secrets that can ultimately lead to remote code execution.
- The Fix: Patch affected Rails installations immediately and rotate exposed secrets if exploitation is suspected.
Ruby on Rails just got another reminder that file uploads are never “just file uploads.”
CVE-2026-66066 affects applications using Active Storage with the libvips image-processing backend.
The vulnerability has a CVSS score of 9.5.
And attackers are already interested.
The Upload Is the Attack Surface
Active Storage handles uploaded files in Rails applications.
Images are commonly processed automatically after upload.
That’s where the problem appears.
A specially crafted image can abuse the way Rails invokes libvips, allowing an attacker to manipulate the processing pipeline and cause the application to read files that should never be accessible.
The attacker doesn’t need to know the contents beforehand.
They need to get the application to process the right payload.
Arbitrary File Read Is Bad Enough
Reading arbitrary files from a production Rails server can expose sensitive application data.
That can include:
- configuration files
- environment variables
- database credentials
- API tokens
- cloud credentials
- Rails secrets
- private application data
And one file is considerably more interesting than the others.
config/master.key.
Or anything containing the application’s secret_key_base.
Those secrets can turn a seemingly limited file-read primitive into something much worse.
From File Read to Full Compromise
Rails applications rely heavily on cryptographic secrets.
If an attacker obtains the right secret material, they may be able to forge or manipulate signed data, access protected functionality or chain the initial vulnerability with another weakness.
The important point is that CVE-2026-66066 doesn’t have to provide RCE directly to become an RCE problem.
The attacker only needs to read the credentials that provide the next step.
That’s how real intrusions are built.
One vulnerability opens the door.
The secrets behind it open the rest of the building.
Why libvips Matters
The vulnerability isn’t a generic “all Rails installations are broken” situation.
The affected attack path depends on the image-processing configuration.
Applications using Active Storage with libvips are particularly relevant.
That means defenders shouldn’t simply search their environment for the CVE number.
They need to determine how Active Storage is configured and which image-processing backend is actually being used.
Patch First. Investigate Second.
If you operate a Rails application exposed to the Internet, this isn’t a vulnerability to leave in the backlog.
Patch the affected Rails components.
Then inspect application logs for suspicious upload activity.
Look for:
- unusual image uploads
- unexpected requests to Active Storage endpoints
- abnormal
libvipsprocessing - access to files outside normal application paths
- suspicious requests immediately preceding authentication anomalies
If you find evidence that arbitrary files were exposed, assume secrets may have leaked.
Rotate the Secrets
Patching stops the vulnerability.
It doesn’t undo what an attacker may already have read.
If the server was potentially compromised, rotate:
secret_key_base- Rails master keys
- database passwords
- cloud credentials
- API tokens
- third-party service credentials
Don’t rotate only the password you think was targeted.
An attacker who obtained server-side configuration may have collected considerably more.
The Real Problem Is the Chain
This is why CVSS alone doesn’t tell the whole story.
The initial bug is:
malicious upload → arbitrary file read
The interesting chain is:
file read → Rails secrets → forged credentials / application access → deeper compromise
And if the application has access to cloud infrastructure, databases or internal services, the blast radius can extend well beyond the Rails server.
Bugstoday Opinion
A 9.5 vulnerability in a popular web framework is already bad.
An actively exploited one is worse.
But the thing defenders should really fear is the second step.
Attackers don’t necessarily need a perfect RCE exploit.
Give them arbitrary file read on a badly configured production application and they may find the credentials needed to manufacture their own way forward.
That’s the recurring lesson with web application security:
the secret sitting next to the vulnerability can be more valuable than the vulnerability itself.
Bugstoday verdict: if your Rails application uses Active Storage with libvips, stop treating this as a theoretical framework bug. Patch it, inspect the logs and rotate secrets if the application may have been touched.
Today’s Bugs. Tomorrow’s Breaches.
