Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

CVE-2026-66066 is a critical vulnerability (CVSS 9.5) in Ruby on Rails' Active Storage component. The flaw exists at the trust boundary between Active Storage and libvips. libvips supports loaders, savers, and other operations, some backed by third-party libraries marked 'unfuzzed' or 'untrusted' because they are unsafe for hostile input. Active Storage failed to block these untrusted operations, allowing a crafted image upload to invoke one and disclose arbitrary files readable by the Rails worker process. Both the Vips analyzer and transformer passed untrusted attachments to the unsafe operations. A successful exploit gives an unauthenticated attacker an arbitrary file-read primitive, potentially exposing secret_key_base, Rails master key, database passwords, cloud storage credentials, and API tokens. These extracted secrets could further enable remote code execution (RCE) or lateral movement into connected systems. Generating image variants is not a prerequisite for exploitation. The fix calls Vips.block_untrusted(true) when Active Storage starts. No proof-of-concept was publicly available as of July 29, 2026 at 17:30 UTC, and no in-the-wild exploitation had been reported.