Ruby on Rails has patched a critical vulnerability (CVE-2026-66066, CVSS 9.5) that could let unauthenticated attackers read arbitrary files and achieve remote code execution. The flaw affects applications using the libvips library for Active Storage image processing that accept uploads from untrusted users — a very common setup. Attackers could upload a crafted file to expose secrets like secret_key_base, then escalate to full RCE or lateral movement. Fixes are available in Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Updating libvips to at least version 8.13 is also required. As of July 30, no active exploitation has been detected, but any previously exposed secrets should be rotated immediately.
Source: SecurityWeek