A critical security flaw in the Active Storage component of the Ruby on Rails web application framework has been resolved. The defect allows unauthenticated remote network actors to read arbitrary system files from application servers, facilitating master secret key exfiltration and remote code execution.
The vulnerability, tracked as CVE-2026-66066 carrying a CVSS score of 9.5, affects Rails setups integrated with the libvips image processing engine. The flaw exists at the boundary where Active Storage hands untrusted file attachments to processing subroutines. By submitting a malformed image payload, an attacker forces the server worker to read local environment variables, disclosing SECRET_KEY_BASE credentials, database connections, and cloud API tokens. Possessing master keys allows adversaries to sign malicious serialized objects to gain complete remote execution.
Exposing core process environment variables and master cryptographic keys undermines the security framework of web applications. Once an attacker extracts application secret keys, they can bypass session verification controls, forge administrative login cookies, and execute background commands on host nodes.
– Upgrade web applications immediately to patched Ruby on Rails maintenance releases 7.2.3.2 or 8.1.3.1.
– Audit Active Storage configurations to ensure untrusted image uploads do not invoke unverified libvips processing options.
– Rotate all application secrets, database credentials, and cloud storage API tokens if exposure occurred.
– Implement web application firewall rules to intercept abnormal image upload payloads containing custom headers.
Application framework protection demands rigid input verification at third party library boundaries to ensure file processing engines do not disclose internal system files. #CodeDefence #RubyOnRails #ActiveStorage #ArbitraryFileRead #AppSec #VulnerabilityManagement #RCE
/
