Ruby on Rails Addresses Critical Vulnerability Affecting Server File Security
Ruby on Rails has released patches for a critical vulnerability in its Active Storage component, identified as CVE-2026-66066, which could allow unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. This flaw, with a CVSS score of 9.5, exposes sensitive information such as secret keys and database passwords, potentially enabling remote code execution or lateral movement into connected systems. The vulnerability affects applications using libvips for image processing and accepting uploads from untrusted users. Rails versions 7.0.0 through 8.1.3 are impacted, with specific configurations in earlier versions also at risk. The Rails Security Team has advised operators to upgrade to the latest patched versions and rotate all secrets accessible by the application process. 
