CVE-2026-66066

Name of the Vulnerable Software and Affected Versions activestorage versions prior to 7.2.3.2 activestorage versions 8.0 through 8.0.5 activestorage versions 8.1 through 8.1.3

Description Active Storage fails to disable libvips operations marked as unsafe for untrusted content. This allows an unauthenticated attacker to upload a crafted file, such as a malformed BMP or disguised PNG, to trigger arbitrary file reads from the server. The issue stems from parser confusion where different layers (Rails, libvips, and underlying libraries like libmatio and HDF5) interpret the file type differently, allowing an external file reference to be resolved. Attackers can read sensitive files accessible to the Rails process, including environment variables, database credentials, and application secrets like secret key base. Exposure of these credentials can lead to session forgery, lateral movement, and remote code execution. Over 7,100 internet-facing instances were estimated to be potentially vulnerable, and active exploitation has been observed in the wild.

Recommendations Upgrade activestorage to version 7.2.3.2, 8.0.5.1, or 8.1.3.1. Upgrade libvips to version 8.13 or later. Rotate the secret key base, the master key, and all credentials stored in config/credentials.yml.enc. Rotate database credentials and tokens for all third-party services used by the application. As a temporary workaround for systems with libvips 8.13 or later, set the VIPS BLOCK UNTRUSTED environment variable to disable unsafe operations. As a temporary workaround for applications using ruby-vips 2.2.1 or later, call the Vips.block untrusted(true) function from an initializer. If libvips is used only for image analysis and not Active Storage, remove ruby-vips from the Gemfile. If libvips is version 8.13 or earlier and no upgrade is possible, remove the dependency on libvips entirely.