Listen to this Post
How CVE-2026-66066 Works
CVE-2026-66066 is a critical vulnerability in Ruby on Rails’ Active Storage component when configured to use the libvips image processing library. The flaw stems from Active Storage failing to disable certain libvips operations that are explicitly marked as “unfuzzed” or “untrusted” by the library’s developers. These operations are considered unsafe for processing untrusted content because they are backed by third-party libraries and handle file formats unrelated to web images.
In its default configuration (which uses libvips for Rails 7.0 and later load_defaults), an application that accepts image uploads from untrusted users is vulnerable. An attacker can upload a specially crafted file and trigger the generation of an image variant. Because Active Storage does not filter out the unsafe “unfuzzed” operations, the crafted file can invoke one of these operations during processing.
This allows an unauthenticated attacker to read arbitrary files from the server’s filesystem that are accessible to the Rails application process. The targeted files typically include the process environment, which holds the `secret_key_base` and often contains credentials for databases, cloud storage (S3, GCS, Azure), and other external systems. Exposure of these secrets can lead to a full compromise of the application, enabling remote code execution (RCE) or lateral movement to connected systems. The vulnerability is rated with a CVSSv4 score of 9.5 (Critical).
The attack chain details are being withheld by the reporters (Ethiack and GMO Flatt Security) and the Rails team until August 28, 2026, to allow administrators time to patch. However, the Rails team is aware of at least one working mechanism and does not assume it is the only one. Affected versions include `activestorage` prior to 7.2.3.2, versions 8.0.x before 8.0.5.1, and versions 8.1.x before 8.1.3.1. The fix requires upgrading both Active Storage and libvips to versions that support blocking these unsafe operations.
DailyCVE Form
Platform: Rails Active Storage
Version: <7.2.3.2, 8.0<8.0.5.1, 8.1<8.1.3.1
Vulnerability: Arbitrary File Read / RCE
Severity: Critical (CVSS 9.5)
Date: 2026-07-29
Prediction: 2026-08-28 (disclosure date)
What Undercode Say
Check Rails version bundle list | grep activestorage Check libvips version vips --version Check if vulnerable to CVE-2026-66066 Vulnerable if: - activestorage < 7.2.3.2 - activestorage >= 8.0.0 and < 8.0.5.1 - activestorage >= 8.1.0 and < 8.1.3.1 AND libvips < 8.13 Workaround: Block untrusted operations (libvips >= 8.13 required) export VIPS_BLOCK_UNTRUSTED=1 Or in Ruby (ruby-vips >= 2.2.1) In config/initializers/vips.rb: Vips.block_untrusted(true) if defined?(Vips)
Exploit
The exploit leverages a crafted file uploaded to a Rails application that uses Active Storage with libvips. When the application generates a variant (e.g., via `variant` or preview), the unsafe “unfuzzed” libvips operation is invoked. This operation can read arbitrary files from the server, such as `/proc/self/environ` or config/credentials.yml.enc, exposing `secret_key_base` and other secrets.
Public proof-of-concept code exists, but the full attack chain is withheld until 2026-08-28. The vulnerability is triggered without authentication, and variant generation is not a prerequisite—merely uploading a file and having it processed is sufficient.
Protection
- Upgrade Active Storage to a patched version: 7.2.3.2, 8.0.5.1, or 8.1.3.1.
2. Upgrade libvips to version 8.13 or later.
- Rotate all exposed secrets:
secret_key_base, master key, credentials, database passwords, and third-party tokens. - Workaround (if libvips >= 8.13 but cannot upgrade Rails immediately): Set the environment variable
VIPS_BLOCK_UNTRUSTED=1, or call `Vips.block_untrusted(true)` in an initializer (requires ruby-vips >= 2.2.1). - If libvips < 8.13: No workaround exists; remove libvips dependency (e.g., remove `ruby-vips` from Gemfile).
Impact
- Confidentiality: Unauthenticated attackers can read arbitrary files, including environment secrets, leading to full compromise.
- Integrity: With exposed `secret_key_base` and other credentials, attackers can forge signed cookies, perform RCE, and modify data.
- Availability: RCE can lead to denial of service or complete system takeover.
- Lateral Movement: Exposed credentials for external services (S3, GCS, Azure, databases) allow attackers to pivot to connected systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
