CVE-2026-66066 in Rails
Summary
by MITRE • 07/30/2026
Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
Active Storage within the Rails framework presents a critical security vulnerability that stems from insufficient validation of libvips operations during image processing. This flaw exists in versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1 where the system fails to properly disable potentially dangerous libvips operations when handling untrusted user uploads. The vulnerability manifests when applications configured to use libvips for image processing accept file uploads from unauthenticated users, creating an attack surface where malicious payloads can trigger unsafe operations within the underlying image processing library.
The technical implementation of this vulnerability involves the manipulation of image file formats that support embedded metadata and processing instructions. When Active Storage processes these crafted images through libvips, it executes operations that were designed for trusted environments but become dangerous when triggered by unverified input. This represents a classic case of insufficient input validation and unsafe operation execution within the context of web application security. The flaw aligns with CWE-20, which addresses improper input validation, and specifically relates to CWE-78, concerning OS command injection, as the vulnerable operations can potentially access system resources through file read operations.
The operational impact of this vulnerability extends beyond simple information disclosure, creating potential pathways for more severe compromise scenarios. An attacker exploiting this vulnerability can read arbitrary files accessible to the Rails process, including sensitive configuration data such as secret_key_base values and external service tokens. This exposure creates opportunities for remote code execution if the stolen credentials can be used to establish additional attack vectors or for lateral movement within a compromised network environment. The ability to access environment variables and application secrets fundamentally undermines the security posture of affected applications.
From an adversarial perspective, this vulnerability maps directly to several ATT&CK techniques including T1059 for command and scripting interpreter usage and T1566 for credential harvesting through social engineering or exploitation of software vulnerabilities. The attack chain begins with crafting malicious image files that trigger unsafe libvips operations, followed by the extraction of sensitive information from the processing environment. Organizations should consider implementing additional security controls such as network segmentation, file type validation, and privilege separation to limit the potential impact of this vulnerability even when present in their systems.
The remediation strategy requires immediate upgrade to patched versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 depending on the Rails version in use. Security teams should also conduct comprehensive assessments of their application configurations to ensure libvips operations are properly restricted and that file upload handling mechanisms adequately validate input content. Additional defensive measures include implementing strict file type validation, using dedicated processing environments with limited privileges, and monitoring for unusual file processing patterns that might indicate exploitation attempts. The vulnerability demonstrates the importance of securing all components within web application frameworks, particularly those involving third-party libraries and system-level operations that can be influenced by user-provided content.