Ruby on Rails Active Storage vulnerability

In late July 2026, the Ruby on Rails core team issued urgent security updates to address a critical Active Storage flaw (CVE‑2026‑66066) that could allow unauthenticated attackers to read arbitrary files and potentially achieve remote code execution. The patches targeted Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5, and 8.1.0–8.1.3, upgrading them to versions that block untrusted libvips image loaders. The advisory noted a high CVSS score (9.5) and recommended updating bundles, ensuring libvips 8.13+ is installed, and rotating any possibly exposed secrets. No active exploitation was reported at that time.

A few days later, Japan’s Computer Emergency Response Team (JPCERT/CC) released its own advisory, confirming that exploit code for the same vulnerability had been published publicly. The JPCERT warning emphasized that attacks were likely to increase and urged developers to apply the newly released patches immediately, treat any exposed credentials as compromised, and rotate them. The advisory reinforced the importance of timely patching and robust file‑upload validation for Rails‑based services.