CVE-2026-66066: Active Storage Arbitrary File Read and Remote Code Execution Vulnerability
Summary
CVE-2026-66066: Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. Affects activestorage across 3 version ranges.
< 7.2.3.2
>= 8.0.0.beta1, < 8.0.5.1
>= 8.1.0.beta1, < 8.1.3.1
Fixed in 7.2.3.2, 8.0.5.1 or 8.1.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Active Storage is a component of the Ruby on Rails framework that facilitates file uploads and management, particularly for images. It allows developers to easily attach files to their models and provides features for processing and serving those files. However, a vulnerability has been identified in Active Storage's use of the libvips image processing library, which can lead to serious security risks if not addressed.
Vulnerability Detail
The vulnerability arises from Active Storage's configuration that permits the processing of image variants using libvips without disabling unsafe operations. An unauthenticated attacker can exploit this by uploading a specially crafted file, potentially allowing them to read arbitrary files from the server, including sensitive information such as the application's secret keys and credentials. This could lead to remote code execution or lateral movement within the affected systems, posing a significant threat to application security.
How To Fix
Latest published version: 8.1.4 as of 22 Oct 2026
gem install activestorage -v 8.1.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.2.3.27.2.3.2gem install activestorage -v 7.2.3.2 -
>= 8.0.0.beta1, < 8.0.5.18.0.5.1gem install activestorage -v 8.0.5.1 -
>= 8.1.0.beta1, < 8.1.3.18.1.3.1gem install activestorage -v 8.1.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade libvips to version 8.13 or higher, you can mitigate the risk by removing the dependency on libvips from your application. If your application uses ruby-vips solely for image analysis, consider removing it from your Gemfile. Alternatively, if libvips 8.13 or higher is available, you can disable unfuzzed operations by setting the following environment variable:
export VIPS_BLOCK_UNTRUSTED=1
Or, if using ruby-vips version 2.2.1 or later, you can add the following line to an initializer:
Vips.block_untrusted(true)
Conclusion
CVE-2026-66066 represents a significant security risk for applications using Active Storage with libvips for image processing. It is crucial for developers to upgrade to the patched versions of Active Storage and libvips to mitigate the risks associated with this vulnerability. Regular monitoring and vulnerability management practices, such as those offered by Vulert, can help maintain application security.
See every vulnerability recorded for activestorage →
FAQ
CVE-2026-66066 is a critical vulnerability in Active Storage that allows unauthorized file access and potential remote code execution due to improper handling of image processing.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
If exploited, this vulnerability can lead to unauthorized access to sensitive files, including secret keys and credentials, potentially allowing attackers to execute arbitrary code.
If immediate upgrades are not possible, consider implementing the suggested workarounds, such as disabling unfuzzed operations or removing the libvips dependency.
The CVSS score for CVE-2026-66066 is 9.5, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for activestorage.
