CVE-2026-66066 is a critical vulnerability in the Rails Active Storage framework that permits unauthenticated attackers to upload specially crafted images processed by libvips, enabling arbitrary file read on the server and potential escalation to remote code execution. The attack requires that the server accepts image uploads from untrusted users and uses libvips prior to version 8.13. Exploitation can expose sensitive files such as the process environment containing secret_key_base and credentials, which attackers can leverage to forge session cookies and manipulate serialized data, leading to full RCE. The vulnerability affects Active Storage versions before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1; Rails 6.x is affected only if Active Storage is configured outside defaults. Mitigations include upgrading Rails to fixed versions, upgrading libvips to 8.13 or later, rotating all secrets, and optionally disabling vulnerable libvips functionality. ImageMagick users are not impacted. The Rails team initially delayed full disclosure to allow patching but released full details after public proof-of-concept exploits appeared. Akamai has published WAF rules to mitigate attacks.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server, including sensitive application secrets such as secret_key_base and database credentials. With these secrets, attackers can forge session cookies, sign global IDs, and manipulate serialized data, resulting in full remote code execution on the underlying server. This compromises the confidentiality, integrity, and availability of the affected Rails application and its data.

A fix is available by upgrading Rails Active Storage to versions 7.2.3.2 or later, 8.0.5.1 or later, or 8.1.3.1 or later. Additionally, upgrade libvips to version 8.13 or newer. For systems running libvips 8.13 or later, administrators can temporarily disable the vulnerable functionality by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) in ruby-vips 2.2.1 or newer. Rotate the secret_key_base, database credentials, Active Storage service credentials, and any other secrets accessible to the application process after patching. No workaround exists for libvips versions prior to 8.13. ImageMagick users are not affected by this vulnerability. Web application firewall (WAF) protections are available from Akamai and may provide additional defense but should not replace patching.