A critical security flaw in the Active Storage component of the Ruby on Rails web framework has been disclosed, allowing unauthenticated remote attackers to read arbitrary files from application servers. The vulnerability permits adversaries to extract sensitive application environment files and cryptographic master keys.
The vulnerability, tracked as CVE-2026-66066 with a CVSS score of 9.5, affects Rails applications configured with the libvips image processing engine that accept file uploads from untrusted users. The flaw exists at the trust boundary between Active Storage and libvips subroutines, where untrusted file attachments trigger unverified image loader operations. By submitting malformed image files, an attacker forces the worker process to read local environment variables, disclosing SECRET_KEY_BASE tokens, database passwords, and cloud storage keys. Armed with recovered master keys, attackers can sign malicious serialized payloads to achieve remote code execution.
Exposing core process environment variables and master cryptographic secrets compromises the entire hosting environment. Once an adversary recovers application secret keys, they can bypass session verification controls, forge administrative authentication tokens, and execute arbitrary background code on target host nodes.
– Upgrade web applications immediately to patched Rails release tiers 7.2.3.2 or 8.1.3.1.
– Audit Active Storage configurations to ensure untrusted image uploads do not invoke unverified libvips loader operations.
– Rotate all application secrets, database credentials, and cloud API tokens if an unpatched exposure window occurred.
– Implement web application firewall rules to intercept and block abnormal image upload payloads carrying custom file headers.
Web application framework resilience depends on enforcing strict input verification at third-party library boundaries to guarantee that processing engines do not disclose internal system files. #CodeDefence #RubyOnRails #ActiveStorage #ArbitraryFileRead #AppSec #VulnerabilityManagement #RCE
/
