The Rails core team has patched a critical Active Storage flaw that let an unauthenticated attacker turn a routine image upload into full read access to a server’s secrets, including the credential that signs every session and cookie in the application.
Tracked as CVE-2026-66066 and disclosed through GitHub Security Advisory GHSA-xr9x-r78c-5hrm on July 29, 2026, the flaw carries a CVSS score of 9.5. It sits in how Active Storage hands uploaded files to libvips, the image-processing library that has been the default variant processor since Rails 7.0. Active Storage did not disable libvips’ untrusted-input loaders before processing user-supplied images, so an attacker who uploads a crafted file and triggers variant generation, something as ordinary as a profile photo, can read arbitrary files on the server, including the process environment where secret_key_base, the Rails master key, database passwords, and cloud storage credentials typically live. Affected versions span Rails 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3; the team shipped 7.2.3.2, 8.0.5.1, and 8.1.3.1 as fixes.
Why it matters to the security leader: any application that accepts file uploads from users and uses Active Storage’s default image processor is exposed regardless of authentication, and the advisory is explicit that patching alone does not undo the damage. Because secret_key_base can be used to forge session cookies and decrypt encrypted cookies, an attacker who read it before the patch retains that capability afterward. The advisory instructs teams to rotate every secret the application process could access, not just apply the update, which turns a routine dependency bump into a credential-rotation exercise across databases, API keys, and encryption keys.
The one original wrinkle: the root cause lives in libvips’ willingness to run “unfuzzed,” less-hardened loaders by default, not in Rails’ own code, so any framework that pipes untrusted uploads through libvips should check its exposure too. For anyone who cannot patch immediately, Rails recommends upgrading libvips to 8.13 or later and setting VIPS_BLOCK_UNTRUSTED=true. As CyberTech has covered before, the gap between disclosure and exploitation keeps shrinking, so treat this as a same-day patch-and-rotate task, not scheduled maintenance.
