Cover image for Patch Your Rails: Active Storage CVE-2026-66066

christine

Rails disclosed CVE-2026-66066 this week: a possible arbitrary file read and remote code execution in Active Storage variant processing. If your app accepts image uploads and uses libvips, stop reading and go patch.

Am I Affected?

You're affected if both of these are true:

  • Your app uses libvips for Active Storage (config.active_storage.variant_processor = :vips)
  • Untrusted users can upload images that get variants generated

Affected versions:

  • activestorage < 7.2.3.2
  • activestorage >= 8.0, < 8.0.5.1
  • activestorage >= 8.1, < 8.1.3.1

What's the Risk?

libvips marks some of its file format handlers as "unfuzzed operations," meaning they're not safe for untrusted content. Active Storage didn't disable them. So an attacker who uploads a crafted file and triggers variant generation can potentially read arbitrary files on the server, pull environment variables like secret_key_base, and from there escalate to remote code execution.

What to Do

  1. Upgrade activestorage to 7.2.3.2, 8.0.5.1, or 8.1.3.1. The easy way is bundle update rails --conservative, which bumps Rails to the patch release without updating anything else in your Gemfile.lock.
  2. Make sure libvips is >= 8.13.
  3. Rotate your secrets. The advisory is blunt about this: treat every secret readable by the application process as potentially exposed.

That third step is the one people skip. If your app was vulnerable, patching alone doesn't help you if someone already read your credentials.

If You Can't Upgrade Yet

There are workarounds, but only on libvips >= 8.13:

  • Set the VIPS_BLOCK_UNTRUSTED environment variable
  • Or call Vips.block_untrusted(true) from an initializer (requires ruby-vips >= 2.2.1)

On libvips older than 8.13, there is no workaround. Upgrade.

The advisory: CVE-2026-66066