Rails: In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing… (CVE-2026-66066)
In Rails versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1, Active Storage does not disable unsafe libvips operations for untrusted content. This allows crafted image uploads to invoke unsafe operations. Applications using libvips and accepting uploads from untrusted users are vulnerable. An unauthenticated attacker can read arbitrary files accessible to the Rails process, including environment variables and secrets. Exposure of credentials like secret_key_base may lead to remote code execution or lateral movement. The issue is fixed in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.
AI Analysis
Technical Summary
Active Storage in Rails versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1 fails to disable libvips operations marked unsafe for untrusted content. This vulnerability allows an unauthenticated attacker to upload crafted images that trigger unsafe libvips operations, enabling arbitrary file reads within the Rails process context. Sensitive data such as environment variables and application secrets, including secret_key_base and external service tokens, may be exposed. Such exposure can facilitate remote code execution or lateral movement within affected environments. The vulnerability is addressed in the specified fixed versions.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to read arbitrary files accessible to the Rails process, including sensitive environment variables and application secrets. This exposure may lead to further compromise such as remote code execution or lateral movement within the affected system. The impact is significant for applications configured to use libvips for image processing and accepting uploads from untrusted users.
Mitigation Recommendations
Upgrade Rails to version 7.2.3.2, 8.0.5.1, or 8.1.3.1 or later, where this vulnerability has been fixed. Applications should ensure they are not using vulnerable versions. No alternative mitigations are specified by the vendor advisory. Patch status is confirmed fixed in these versions.
Rails: In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing… (CVE-2026-66066)
Description
In Rails versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1, Active Storage does not disable unsafe libvips operations for untrusted content. This allows crafted image uploads to invoke unsafe operations. Applications using libvips and accepting uploads from untrusted users are vulnerable. An unauthenticated attacker can read arbitrary files accessible to the Rails process, including environment variables and secrets. Exposure of credentials like secret_key_base may lead to remote code execution or lateral movement. The issue is fixed in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Active Storage in Rails versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1 fails to disable libvips operations marked unsafe for untrusted content. This vulnerability allows an unauthenticated attacker to upload crafted images that trigger unsafe libvips operations, enabling arbitrary file reads within the Rails process context. Sensitive data such as environment variables and application secrets, including secret_key_base and external service tokens, may be exposed. Such exposure can facilitate remote code execution or lateral movement within affected environments. The vulnerability is addressed in the specified fixed versions.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to read arbitrary files accessible to the Rails process, including sensitive environment variables and application secrets. This exposure may lead to further compromise such as remote code execution or lateral movement within the affected system. The impact is significant for applications configured to use libvips for image processing and accepting uploads from untrusted users.
Mitigation Recommendations
Upgrade Rails to version 7.2.3.2, 8.0.5.1, or 8.1.3.1 or later, where this vulnerability has been fixed. Applications should ensure they are not using vulnerable versions. No alternative mitigations are specified by the vendor advisory. Patch status is confirmed fixed in these versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xr9x-r78c-5hrm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-66066"]
- Ecosystems
- ["RubyGems"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
Threat ID: 6a6bde219c2644c7f8dcb7c2
Added to database: 07/30/2026, 23:28:33 UTC
Last enriched: 08/07/2026, 03:36:49 UTC
Last updated: 09/13/2026, 11:57:43 UTC
Views: 146
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.