Rails Active Storage Flaw Enables Arbitrary File Read, Possible RCE via libvips (CVE-2026-66066)

What Happened

Rails maintainers disclosed GHSA-xr9x-r78c-5hrm (CVE-2026-66066), a critical vulnerability in Active Storage's image variant processing. According to the advisory, applications using libvips as the variant processor (config.active_storage.variant_processor = :vips, the default since load_defaults 7.0) may allow an unauthenticated attacker to read arbitrary files from the server by uploading a crafted file that triggers variant generation.

The root cause is that libvips exposes certain "unfuzzed" loader/saver operations that are unsafe for untrusted input, and Active Storage did not disable them. One exploitation chain has been reported to Rails, though the advisory notes it may not be the only one. Full technical details are being withheld until at least 2026-08-28 to limit immediate copycat exploitation, but exploit activity is already tracked as PoC-public.

Why It Matters

Arbitrary file read on a Rails server is severe on its own — it can expose secret_key_base, the Rails master key, config/credentials.yml.enc contents, and other environment secrets. The advisory explicitly warns this can cascade into remote code execution or lateral movement into connected systems (databases, cloud storage credentials, third-party service tokens). Any Rails app that accepts image uploads from untrusted users and processes variants via libvips is potentially affected — a common configuration for public-facing applications with avatars, media uploads, or user-generated content.

What Defenders Should Do Now

• Identify all Rails applications using Active Storage with the vips variant processor and confirm their libvips version.
• Upgrade activestorage to a fixed release (activestorage >= 7.2.3.2, >= 8.0.5.1, or >= 8.1.3.1) and ensure libvips is >= 8.13, which is required to disable unfuzzed operations.
• As an interim mitigation, set the VIPS_BLOCK_UNTRUSTED environment variable or call Vips.block_untrusted(true) in an initializer if libvips >= 8.13 is already present.
• Treat any exposed environment as compromised: rotate secret_key_base, the Rails master key, Active Storage service credentials (S3/GCS/Azure), database credentials, and any third-party API tokens.
• Hunt for anomalous file uploads followed by unusual file-read patterns or process behavior around variant generation endpoints, and review logs for unexpected access to sensitive paths from the application process.

Developing Intel

This is a same-day critical advisory with limited technical detail by design — Rails maintainers are withholding attack chain specifics until 2026-08-28. Organizations running affected Active Storage versions should prioritize patching now rather than waiting for full disclosure. See the original advisory for authoritative guidance: GHSA-xr9x-r78c-5hrm.