Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Read original article ↗AI Summary
A critical vulnerability in Ruby on Rails, tracked as CVE-2026-66066 with a CVSS score of 9.5, allows unauthenticated attackers to read arbitrary files from server environments via crafted image uploads when using libvips for Active Storage processing. The flaw affects Rails versions 6.0 through 8.1.3 under specific configurations and could expose sensitive credentials such as secret_key_base, database passwords, and cloud storage keys, potentially enabling remote code execution or lateral movement. No in-the-wild exploitation has been reported at the time of publication, and researchers have not released a proof-of-concept. The patch requires upgrading Rails and libvips, or applying runtime mitigations using VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true).
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.