Critical RCE Vulnerability in Rails Active Storage Disclosed

On July 29, 2026, the Ruby on Rails security team published CVE-2026-66066, a critical arbitrary file read and remote code execution (RCE) vulnerability in Active Storage. Discovered by the Ethiack research team, this flaw affects default configurations of Rails 6.x, 7.x, and 8.x that utilize the vips image processor. Attackers can exploit this vulnerability to read arbitrary files on the server, including sensitive credentials, without authentication in certain setups. The vulnerability has been assigned a CVSS score of 9.5 and affects an estimated 500,000+ sites. Fixes were released in Rails versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Users are advised to upgrade immediately to mitigate the risk. The vulnerability is particularly concerning due to the widespread use of Active Storage in production applications.

Key Points: • CVE-2026-66066 is a critical RCE vulnerability affecting Rails Active Storage. • The flaw allows unauthenticated attackers to read arbitrary files on the server. • Patches are available in specific Rails versions; users must upgrade to secure their applications.