Full research report

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-66066 is a well-evidenced critical vulnerability in Ruby on Rails Active Storage, confirmed by two independent research teams and patched on the same day as disclosure. The root cause is an architectural trust-boundary failure: Active Storage delegated processing of untrusted uploads to libvips without disabling the library's unfuzzed operation handlers — a category libvips itself marks as hostile-input unsafe. The cascading risk is unusually severe because the file-read primitive directly targets the Rails process environment, which commonly holds signing keys that unlock a second tier of impact: session forgery, deserialisation-based code execution, and credential-based lateral movement into connected infrastructure. A third-party PoC appeared within hours of disclosure and claims the full chain, materially narrowing the patching window even though it remains independently unvalidated. Operators on libvips below 8.13 face an additional hard dependency constraint: the Rails patch itself cannot take effect without a libvips upgrade, making library currency as urgent as the Rails version bump.

What happened

On 29 July 2026, the Ruby on Rails security team disclosed CVE-2026-66066 (CVSS v4 9.5), a critical arbitrary-file-read vulnerability in Active Storage's libvips-based image variant processing, and simultaneously released patched versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. The flaw was independently discovered by Ethiack (André Baptista, Bruno Mendes, Rafael Castilho) and GMO Flatt Security (RyotaK), neither of whom disclosed the technical attack chain. A third-party PoC claiming a full file-read-to-RCE chain appeared on GitHub later the same day but has not been independently validated. The Rails Security Team stated it was not aware of exploitation before or after disclosure.

Affected scope

Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5, and 8.1.0–8.1.3 in their default configuration where libvips is the active storage image processor; Rails 6.0.0–6.1.7.10 only when libvips was manually enabled. Applications using MiniMagick are not exposed through this attack path. Rails 7.1 and earlier are end-of-life and will receive no backport. Ethiack estimates over 500,000 sites may fall within scope, noting libvips is the default in official Rails Docker images and Debian/Ubuntu packages.

Technical assessment

Active Storage passed untrusted file uploads to libvips without first disabling its 'unfuzzed' operations — handlers the libvips project itself marks as unsafe for hostile input. A crafted upload that triggers variant processing invokes one of these handlers and reads arbitrary files accessible to the Rails worker process, including environment variables that typically hold secret_key_base, the Rails master key, database credentials, and cloud-storage tokens. The patch applies Vips.block_untrusted(true) at Active Storage start-up; this requires libvips 8.13 or later because older versions cannot enforce the block at all. Exposure of secret_key_base creates a secondary risk: an attacker who recovers that value can sign arbitrary data, potentially forging session tokens or triggering deserialisation of attacker-controlled Ruby Marshal objects to achieve code execution.

Recommended defensive actions

  1. Upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and verify libvips is at version 8.13 or later and ruby-vips at 2.2.1 or later before restarting application processes.
  2. Rotate every secret accessible to the Rails process immediately after patching: secret_key_base, Rails master key and decrypted credentials, database passwords, Active Storage service keys, and all third-party API tokens.
  3. Apply the VIPS_BLOCK_UNTRUSTED environment variable or call Vips.block_untrusted(true) in an initialiser as an immediate stopgap on systems running libvips 8.13+ that cannot patch Rails right away.
  4. Upgrade libvips to 8.13 or later if currently below that version; on older libvips builds the Rails patch cannot be applied and the library must be removed or the processor switched to MiniMagick.
  5. Hunt for signs of pre-patch exploitation by reviewing Active Storage and web server access logs for uploads of unusual file types (including HDF5 and MATLAB formats) combined with variant-processing requests, and investigate any anomalous outbound connections from Rails worker processes.

Uncertainties and evidence gaps

  • The precise file format and request construction used to trigger the arbitrary-file-read primitive has not been publicly disclosed; full technical details are embargoed until 28 August 2026.
  • The third-party GitHub PoC (Zer0SumGam3/CVE-2026-66066-POC) has not been independently validated; the completeness and reliability of its claimed RCE chain cannot be confirmed from published evidence.
  • Rails has no telemetry on how many deployed applications use Active Storage with libvips and accept untrusted uploads; the 500,000-site exposure estimate from Ethiack is unverified.
  • Whether exploitation occurred during the period between initial discovery and coordinated disclosure, or in the hours following publication, is unknown.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork access to a Rails application that accepts file uploads from unauthenticated users and processes image variants using libvips.
ComponentRuby on Rails Active Storage variant processing when libvips is configured as the image processor (default from Rails 7.0 load_defaults onwards).
MechanismActive Storage did not disable libvips 'unfuzzed' operations — handlers the libvips project marks as unsafe for attacker-controlled content — before passing user-supplied uploads for processing, leaving an unsanitised trust boundary between the upload handler and the image processing library.
ImpactArbitrary read of any file accessible to the Rails worker process; exposure of environment variables holding secret_key_base, database passwords, and cloud credentials; secondary risk of session forgery or deserialisation-based code execution if signing keys are recovered.
DetectionMonitor Active Storage and web server logs for uploads of non-standard or non-image file types followed by variant-processing requests; alert on unexpected outbound network connections originating from Rails worker processes.
MitigationUpgrade activestorage to 7.2.3.2, 8.0.5.1, or 8.1.3.1 with libvips 8.13+ and ruby-vips 2.2.1+; set VIPS_BLOCK_UNTRUSTED as an interim measure on libvips 8.13+ systems; rotate all secrets accessible to the Rails process after patching.
Exploitation status

No confirmed active exploitation as of 29 July 2026 per the Rails Security Team; CVE-2026-66066 was not listed in the CISA Known Exploited Vulnerabilities catalogue at disclosure; a third-party GitHub repository (Zer0SumGam3/CVE-2026-66066-POC) claims a full file-read-to-RCE chain but has not been independently validated.

Research process

Investigation began with the source article's claim of a critical unauthenticated file-read in Rails Active Storage via libvips, attributed to CVE-2026-66066. The official GitHub security advisory and the Rails community forum post were fetched to confirm vulnerability scope, patch versions, and exploitation status directly from the vendor. Ethiack's disclosure post and the HeroDevs and GBHackers analyses were retrieved to cross-verify affected ranges and assess independent technical depth. A third-party GitHub PoC was located via search and confirmed to exist, materially changing the risk assessment, though its claims remain unvalidated. CISA's KEV catalogue returned HTTP 403, preventing direct verification, but a targeted search found no alerts naming CVE-2026-66066, consistent with the Rails Security Team's statement of no known exploitation.

  1. Does the source article accurately describe a real, vendor-confirmed vulnerability?
    Fetched the primary THN article to extract stated facts for cross-referencing against primary sources.
    thehackernews.com ↗

    Article describes CVE-2026-66066, CVSS 9.5, affecting Rails 7.0–7.2.3.1, 8.0.0–8.0.5, 8.1.0–8.1.3; credits Ethiack and GMO Flatt Security; references GitHub advisory GHSA-xr9x-r78c-5hrm and a third-party PoC that appeared after initial publication.

    why Establishes the factual baseline but THN is secondary reporting; the vendor advisory must be verified independently before the story can be confirmed.

  2. What do vendor and community sources officially state about scope, patches, and exploitation status?
    Fetched the GitHub security advisory and the Rails Discussions forum announcement.
    github.com ↗

    Advisory confirms CVSS v4 9.5, affected activestorage ranges matching THN, patched versions 7.2.3.2/8.0.5.1/8.1.3.1, mandatory libvips 8.13 dependency, and that 'one specific attack chain has been reported' with technical details withheld until 28 August 2026.

    why Official vendor source; confirms the vulnerability is real, patches are released, and exploitation details remain under a controlled embargo — sets the baseline for the exploitation-status field.

  3. What technical context has the discovering research team publicly disclosed?
    Fetched the Ethiack KindaRails2Shell research page.
    ethiack.com ↗

    Ethiack confirmed the affected scope, characterised the impact as arbitrary file read plus potential RCE, and stated all technical details are withheld to allow operator patching time before August 28.

    why Independent corroboration from the credited discovering team; confirms embargo timeline and that both file-read and RCE paths exist, without adding weaponisable specifics.

  4. What independent technical depth and exposure-size context is available?
    Fetched the HeroDevs blog post and the GBHackers article.
    herodevs.com ↗

    HeroDevs classifies the root cause as CWE-1188 (insecure default configuration), estimates 500,000+ exposed sites, and emphasises that patching Rails alone is insufficient without a libvips 8.13 upgrade; GBHackers independently corroborates the libvips unfuzzed-operation mechanism.

    why Two independent non-vendor domains corroborate the advisory; the libvips version dependency is an operationally critical finding that operators may otherwise overlook.

  5. Is a public proof-of-concept available, and what does it actually contain?
    Searched for GitHub PoC repositories, then fetched the Zer0SumGam3 repository to confirm existence and scope.
    github.com ↗

    Repository confirmed to exist; claims a complete file-read-to-RCE chain using an HDF5 file to read /proc/1/environ, recover SECRET_KEY_BASE, construct a signed Marshal payload, and trigger out-of-band code execution via curl on Rails 8.1.3.

    why Confirms a public PoC is available before the August 28 researcher embargo expires, materially raising the exploitation-risk window; however, it is unvalidated third-party code, so actual exploit reliability cannot be certified from this evidence alone.

  6. Has CISA confirmed in-the-wild exploitation by adding CVE-2026-66066 to the Known Exploited Vulnerabilities catalogue?
    Searched for CISA KEV additions referencing CVE-2026-66066; direct fetch of the catalogue returned HTTP 403.

    No CISA alerts or KEV catalogue entries found referencing CVE-2026-66066; the most recent KEV update before disclosure (27 July 2026) named unrelated CVEs.

    why Absence from KEV is consistent with the Rails Security Team's statement of no known exploitation; KEV lag means this absence is corroborating but not conclusive.

Named in this story
TargetsRuby on Rails applications using Active Storage with libvips as the image processorWeb applications on Rails 7.0 or later that accept image uploads from unauthenticated users
Related CVEs CVE-2026-66066

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (1 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok14 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
CISA KEVkev ok1656 records Corroborating1 matched items A page from this source was opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok9 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5309 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok667 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 7 opened outside the registered collection
References & evidence
Reporting-linked PoC claims1
https://github.com/Zer0SumGam3/CVE-2026-66066-POC github.com ↗

Linked by reporting but not validated as PoC by the configured exploit indexes.

Technical references2
github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5 ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

PoC & exploit code1
Zer0SumGam3/CVE-2026-66066-POC – GitHub github.com ↗

Unvalidated third-party PoC claiming full chain: HDF5/MATLAB upload reads /proc/1/environ, recovers SECRET_KEY_BASE, signs a Marshal payload, and triggers code execution via curl callback on Rails 8.1.3.

Vendor & gov advisories2
GHSA-xr9x-r78c-5hrm: Possible arbitrary file read and remote code execution in Active Storage variant processing github.com ↗

Primary vendor advisory; CVSS v4 9.5, full affected-version ranges, patch requirements, libvips version dependency, and secret-rotation guidance.

CVE-2026-66066: Possible arbitrary file read and RCE in Active Storage variant processing – Ruby on Rails Discussions discuss.rubyonrails.org ↗

Official Rails community announcement covering workarounds including VIPS_BLOCK_UNTRUSTED and ruby-vips initialiser call.

Analysis & research3
KindaRails2Shell – Critical RCE in Rails via Active Storage (CVE-2026-66066) | Ethiack ethiack.com ↗

Disclosure post from the lead discovering team; confirms affected scope and that full technical details are embargoed until 28 August 2026.

CVE-2026-66066: Rails Active Storage Arbitrary File Read and RCE – HeroDevs herodevs.com ↗

Independent technical analysis; classifies root cause as CWE-1188 (insecure default), notes libvips version constraint, and estimates 500,000+ potentially exposed sites.

Critical Rails Flaw Lets Unauthenticated Attackers Read Server Files and Execute Code – GBHackers gbhackers.com ↗

Independent corroboration of the libvips unfuzzed-operation mechanism and downstream secret-exposure risk.