--- title: CVE-2026-66066 (activestorage): Possible arbitrary file... description: A critical security vulnerability (CVE-2026-66066) in Rails Active Storage allows unauthenticated attackers to read arbitrary files from the server and... canonical: https://daily.dev/posts/cve-2026-66066-activestorage-possible-arbitrary-file-read-and-remote-code-execution-in-active-sto-pgveoybpp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-66066 (activestorage): Possible arbitrary file read and remote code execution in Active Storage variant processing | daily.dev og:description: A critical security vulnerability (CVE-2026-66066) in Rails Active Storage allows unauthenticated attackers to read arbitrary files from the server and... og:url: https://daily.dev/posts/cve-2026-66066-activestorage-possible-arbitrary-file-read-and-remote-code-execution-in-active-sto-pgveoybpp og:image: https://api.daily.dev/og/posts/PgvEOyBpP.png og:image:alt: CVE-2026-66066 (activestorage): Possible arbitrary file read and remote code execution in Active Storage variant processing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-66066 (activestorage): Possible arbitrary file read and remote code execution in Active Storage variant processing **[RUBYLAND](https://daily.dev/sources/rubyla)** · 2 min read · 0 upvotes · 0 comments ## Summary A critical security vulnerability (CVE-2026-66066) in Rails Active Storage allows unauthenticated attackers to read arbitrary files from the server and potentially achieve remote code execution. Affected applications use libvips for image processing and accept uploads from untrusted users. The vulnerability exposes environment variables including secret_key_base and external credentials. Patched versions are available (7.2.3.2, 8.0.5.1, 8.1.3.1). Workarounds include removing ruby-vips, setting the VIPS_BLOCK_UNTRUSTED environment variable (requires libvips >= 8.13), or calling Vips.block_untrusted(true) from an initializer (requires ruby-vips >= 2.2.1). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CVE-2026-33658 \(activestorage\): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests](https://daily.dev/posts/cve-2026-33658-activestorage-rails-active-storage-has-a-possible-dos-vulnerability-in-proxy-mode--d7ncwb9vs) · RUBYLAND · 0 upvotes · 0 comments - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments --- Tags: [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/cve-2026-66066-activestorage-possible-arbitrary-file-read-and-remote-code-execution-in-active-sto-pgveoybpp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-66066 (activestorage): Possible arbitrary file read and remote code execution in Active Storage variant processing","url":"https://daily.dev/posts/cve-2026-66066-activestorage-possible-arbitrary-file-read-and-remote-code-execution-in-active-sto-pgveoybpp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-66066-activestorage-possible-arbitrary-file-read-and-remote-code-execution-in-active-sto-pgveoybpp"},"datePublished":"2026-07-30T00:24:08.780Z","dateModified":"2026-07-30T12:29:13.699Z","description":"A critical security vulnerability (CVE-2026-66066) in Rails Active Storage allows unauthenticated attackers to read arbitrary files from the server and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-66066-activestorage-possible-arbitrary-file-read-and-remote-code-execution-in-active-sto-pgveoybpp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"rails","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"CVE-2026-66066 (activestorage): Possible arbitrary file read and remote code execution in Active Storage variant processing"}]} ```