Rails patches critical Active Storage flaw with RCE potential

Rails maintainers have published an advisory for a critical vulnerability in the framework’s Active Storage component. Tracked as CVE-2026-66066, the flaw can allow an unauthenticated attacker to read arbitrary files from a Rails application and could potentially escalate to remote code execution. The vulnerability is exploitable when libvips is used. An attacker can upload a specially crafted image to a vulnerable application and read arbitrary files on its server. Somali developers using Rails should check their applications and apply the available fix, particularly where Active Storage and libvips handle image uploads.

Read our sourcing and corrections policy

Related News

Adobe Fixes Critical Flaw in Campaign Classic

Read ➔

OctLurk and SilkLurk Target Governments Across Asia

Read ➔

Critical Rails Flaw Could Expose Server Files

Read ➔