A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE).
Rails is a popular open-source web application framework written in Ruby for building websites and web apps. It uses the built-in Rails component Active Storage for handling file uploads and attachments.
Rails maintainers published an advisory about the CVE-2026-66066 flaw, which received a critical severity rating.
Active Storage may also generate image thumbnails from uploaded media using image processing libraries such as libvips or ImageMagick.
According to the security bulletin, CVE-2026-66066 is exploitable when libvips is used, allowing an attacker to upload a specially crafted image to a vulnerable application and read arbitrary files on the server.
