--- title: Rails patches critical Active Storage flaw with RCE... description: A critical vulnerability (CVE-2026-66066) in Rails' Active Storage framework allows unauthenticated attackers to upload a specially crafted image and read... canonical: https://daily.dev/posts/rails-patches-critical-active-storage-flaw-with-rce-potential-kspiejnzm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rails patches critical Active Storage flaw with RCE potential | daily.dev og:description: A critical vulnerability (CVE-2026-66066) in Rails' Active Storage framework allows unauthenticated attackers to upload a specially crafted image and read... og:url: https://daily.dev/posts/rails-patches-critical-active-storage-flaw-with-rce-potential-kspiejnzm og:image: https://api.daily.dev/og/posts/KSpiejnzM.png og:image:alt: Rails patches critical Active Storage flaw with RCE potential og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rails patches critical Active Storage flaw with RCE potential **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary A critical vulnerability (CVE-2026-66066) in Rails' Active Storage framework allows unauthenticated attackers to upload a specially crafted image and read arbitrary files from the server when libvips is used as the image processor. Accessing files like the process environment can expose the 'secret_key_base', enabling attackers to forge session cookies and escalate to full remote code execution. Affected versions include Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. Mitigations include upgrading to libvips 8.13+, rotating all secrets and credentials, and applying available WAF protections. Public PoC exploits emerged quickly, prompting the Rails team to release full technical details and forensic investigation tooling ahead of the originally planned disclosure date. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments - [CVE-2026-33658 \(activestorage\): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests](https://daily.dev/posts/cve-2026-33658-activestorage-rails-active-storage-has-a-possible-dos-vulnerability-in-proxy-mode--d7ncwb9vs) · RUBYLAND · 0 upvotes · 0 comments - [Ruby, Rails & AI Daily — September 10, 2026" description: "A critical Active Storage RCE is now under active exploitation, ZJIT learns to inline GC allocations, and Google, Anthropic, and OpenAI all s](https://daily.dev/posts/ruby-rails-ai-daily-september-10-2026-description-a-critical-active-storage-rce-is-now-unde-xetkjqgtn) · Ruby Flow · 2 upvotes · 0 comments --- Tags: [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/rails-patches-critical-active-storage-flaw-with-rce-potential-kspiejnzm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rails patches critical Active Storage flaw with RCE potential","url":"https://daily.dev/posts/rails-patches-critical-active-storage-flaw-with-rce-potential-kspiejnzm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rails-patches-critical-active-storage-flaw-with-rce-potential-kspiejnzm"},"datePublished":"2026-08-01T14:28:51.058Z","dateModified":"2026-08-05T02:00:50.931Z","description":"A critical vulnerability (CVE-2026-66066) in Rails' Active Storage framework allows unauthenticated attackers to upload a specially crafted image and read...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6a9eb237e45200211e87a83d706237ba?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6a9eb237e45200211e87a83d706237ba?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rails-patches-critical-active-storage-flaw-with-rce-potential-kspiejnzm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"rails","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Rails patches critical Active Storage flaw with RCE potential"}]} ```