Active Storage libvips unsafe operations let crafted image uploads read arbitrary files and Rails secrets (CVE-2026-66066)
VulnCheck added the flaw to its known-exploited catalog yesterday after its canary sensors observed exploitation, and public exploit code is available, so Rails apps that accept image uploads via libvips can have application secrets read right now.
Active Storage in Rails before 7.2.3.2, 8.0.5.1, and 8.1.3.1 fails to disable libvips operations marked unsafe for untrusted content. A crafted image upload from an unauthenticated attacker can invoke such an operation to read arbitrary files accessible to the Rails process, including environment variables and application secrets such as secret_key_base.
Affected: rails < 7.2.3.2; rails >= 8.0.0.beta1, < 8.0.5.1; rails >= 8.1.0.beta1, < 8.1.3.1
How to Test
Confirm your Rails version and whether Active Storage is configured to use libvips as the variant processor; if both apply and you accept untrusted image uploads, treat the app as exposed, run the rails-forensics-CVE-2026-66066 tooling to check for indicators, and review upload logs for suspicious image files.
How to Patch
Upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1; until you can, stop accepting untrusted image uploads or switch Active Storage off libvips, and rotate secret_key_base and any environment-held credentials if you find signs of exploitation.