AIKIDO-2026-333731
activestorage is vulnerable to Arbitrary File Read
95
Critical Risk
This Affects:
activestorageTL;DR
Active Storage leaves libvips unfuzzed and untrusted loaders and savers enabled when using the default :vips variant processor, so crafted uploaded images can invoke operations that are not safe for untrusted content. An unauthenticated attacker who can upload a file and trigger variant processing can read arbitrary files reachable by the app process, including environment values such as secret_key_base and other credentials, which can escalate to remote code execution or lateral movement. The fix calls Vips.block_untrusted(true) during Active Storage boot so those untrusted operations are disabled before transformers or analyzers run.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, your application uses Active Storage with config.active_storage.variant_processor = :vips (the default since load_defaults 7.0), and untrusted users can upload images.
Background info
activestorage is vulnerable to Arbitrary File Read in versions 5.2.0 - 7.2.3.1, 8.0.0 - 8.0.5 and 8.1.0 - 8.1.3.
How to fix this
Upgrade the activestorage library to the patch version.
Links
GitHub Releases
Fix Commits
github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1egithub.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49aOther
github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml
thehackernews.com/2026/07/critical-rails-flaw-could-let.htmlopenwall.com/lists/oss-security/2026/07/29/9openwall.com/lists/oss-security/2026/08/01/6ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066github.com/rails/rails-forensics-CVE-2026-66066
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.