Rails Active Storage flaw allows arbitrary file reads via image variants

Rails has fixed a critical Active Storage vulnerability that can let an unauthenticated attacker read arbitrary files from the server, including process environment variables that commonly hold secret_key_base and credentials for external systems.

CVE-2026-66066 affects applications that use libvips as the variant processor (the default since Rails 7.0 load_defaults) and accept image uploads from untrusted users. libvips exposes loaders and other operations, some backed by third-party libraries and marked unsafe for untrusted input, including handlers for formats unrelated to ordinary web images. Active Storage did not disable those operations, so a crafted upload that triggers variant generation can invoke them and disclose filesystem contents.

The advisory, published by byroot, states that one concrete attack chain has been reported and that the project does not assume it is the only one. Leaked environment data can enable remote code execution or lateral movement to other systems. Generating variants is not a separate prerequisite beyond the libvips setting and untrusted uploads.

Fixed releases are Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1. Applications on earlier 7.2, 8.0, or 8.1 lines that match the affected configuration should upgrade.