Ruby on Rails Issues Critical Active Storage Patch for CVE‑2026‑66066

Ruby on Rails released urgent security updates on July 29 2026 to fix a critical Active Storage vulnerability (CVE‑2026‑66066) that allowed unauthenticated attackers to read arbitrary files from application servers via crafted image uploads using the libvips library. The flaw, rated CVSS 9.5, could expose the Rails master key, database passwords, cloud‑storage credentials and other secrets, potentially enabling remote code execution or lateral movement.

The patches upgrade affected Rails versions 7.0.0–7.2.3.1, 8.0.0–8.0.5 and 8.1.0–8.1.3 to new releases 7.2.3.2, 8.0.5.1 and 8.1.3.1, respectively. They work by calling Vips.block_untrusted(true) at boot, disabling untrusted libvips image loaders. Applications must run a bundle update, ensure libvips 8.13 or later is installed, and rotate any secrets that may have been exposed. No exploitation in the wild has been reported. The issue was independently reported by researchers André Baptista, Bruno Mendes and Rafael Castilho of Ethiack and Ryota K of GMO Flatt Security.