A critical vulnerability (CVE-2026-66066, CVSSv4 9.5) has been disclosed in Ruby on Rails affecting Active Storage image processing when using the libvips library. An unauthenticated attacker can craft a malicious image upload to trigger unsafe libvips operations, potentially reading arbitrary files accessible to the Rails process — including secrets that could enable remote code execution. Applications using Rails 7.0+ defaults are affected by default since Vips is the default variant processor. Patched releases are 7.2.3.2, 8.0.5.1, and 8.1.3.1, and libvips must be updated to 8.13 or later. Updating Rails alone is insufficient if libvips is outdated. Organizations are also advised to rotate all secrets accessible to the application process. Workarounds include setting VIPS_BLOCK_UNTRUSTED or calling Vips.block_untrusted(true). No confirmed exploitation in the wild as of July 30, 2026.
