Ruby on Rails Patches Critical RCE Vulnerability

Patch critical Ruby on Rails vulnerability (CVE-2026-66066) affecting Active Storage. Update libvips and ruby-vips, then rotate your secrets.

By Content Team

Aug 2, 2026

ON THIS PAGE

Ruby on Rails has patched a critical vulnerability (CVE-2026-66066, CVSS 9.5) that could let unauthenticated attackers read arbitrary files and achieve remote code execution. The flaw affects applications using the libvips library for Active Storage image processing that accept uploads from untrusted users — a very common setup.

Attackers could upload a crafted file to expose secrets like secret_key_base, then escalate to full RCE or lateral movement. Fixes are available in Active Storage versions 7.2.3.2, 8.0.5.1 and 8.1.3.1. You also need libvips 8.13 or later and, where ruby-vips is installed, ruby-vips 2.2.1 or later.

No active exploitation had been detected as of July 30, but proof-of-concept exploit code is already public — researchers reverse-engineered the flaw and published working chains, prompting Rails to bring its full technical disclosure forward from August 28.

Rotate everything the application process could reach: secret_key_base, the Rails master key and the credentials it decrypts, storage service and database credentials, and third-party service tokens.

Updated 11 Aug 2026: A Metasploit module for this flaw was published on 3 August, putting a working exploit in the hands of any attacker with the framework installed. Patch and rotate immediately if you haven't.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?