A critical vulnerability tracked as CVE-2026-66066 (CVSS 9.5) has been disclosed in Ruby on Rails, the widely used web framework behind tens of thousands of production applications. The flaw exists at the boundary between Rails’s Active Storage file upload system and the libvips image processing library. When an application accepts untrusted image uploads and processes them with libvips, an attacker can craft a malicious image that invokes unsafe internal operations, resulting in an arbitrary file-read primitive on the server — with no authentication required. Files exposed can include SECRET_KEY_BASE, database credentials, cloud storage keys, and API tokens, which in turn can enable remote code execution or lateral movement within the infrastructure.
Patches are available now. The Rails team released fixed versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 alongside updated versions of libvips (8.13+) and the ruby-vips gem (2.2.1+). Three conditions must all be present for a deployment to be exploitable: the application must use libvips for Active Storage image processing, it must accept image uploads from untrusted users, and it must run on an environment where the required native libraries are available — Debian, Ubuntu, and Docker-based deployments are most at risk. Organizations that cannot update immediately can set the environment variable VIPS_BLOCK_UNTRUSTED=1 with a compatible libvips version, or call Vips.block_untrusted(true) in an initializer with ruby-vips 2.2.1+.
How to check if you’re affected
Affected versions include Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, Rails 8.1.0 through 8.1.3, and Rails 6.0.0 through 6.1.7.10 when explicitly configured to use Vips. Run bundle exec rails --version to check your current version. If your application uses Active Storage with the :vips variant processor and accepts image uploads from end users, treat this as critical and apply the patch immediately. Applications using the default :mini_magick processor or ImageMagick are not affected by this specific flaw.