Skip to content
OriginalSign in
Image: Rapid7

Rapid7Rapid7

Critical Ruby on Rails Bug Exposes Files via Image Upload

Part of the CVE-2026-66066 story · since 30 Jul

Quiet for 9 weekslast report 31 Aug7 articles4 outlets
30 Jul · SecurityOnline first16 Sep2 OctNowThis article2nd of 7
  • Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
  • Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload. This article, 2nd of 7.
  • Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
  • Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
  • Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
  • Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
  • Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.

On July 29, 2026, the Ruby on Rails project acknowledged CVE-2026-66066, a critical vulnerability tied to Active Storage image processing with the libvips library, rated with a CVSSv4 score of 9.5. This flaw allows unauthenticated attackers to read files within the Rails application, potentially leading to remote code execution (RCE). Rails applications using libvips to process image uploads from untrusted sources are at risk. No known exploits were identified as of July 30, 2026, but patching is urgent.

Organizations are advised to upgrade to versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 and ensure libvips 8.13 or later is installed. Temporary workarounds include setting VIPS_BLOCK_UNTRUSTED for approved libvips versions. For full remediation, consult the Ruby on Rails security advisory.

How the story developed

All 7 articles
Quiet for 9 weekslast report 31 Aug7 articles4 outlets

7 articles from 4 outlets since 30 Jul. Quiet since 31 Aug. This was the 2nd report, 12 hours after the first.

Now30 Jul1 Aug3431First reportSecurityOnline · 30 Jul, 04:31This article2nd of 7 · day 0Picked up againafter 4 weeks quiet
  • Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
  • Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload. This article, 2nd of 7.
  • Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
  • Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
  • Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
  • Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
  • Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Thu 30 JulDay 02
    1. Critical Rails flaw exposes files, risks RCE via CVE-2026-6606604:31 · SecurityOnline · First report
    2. Critical Ruby on Rails Bug Exposes Files via Image Upload16:59 · Rapid7 · This article, 2nd of 7

  2. Quiet for 2 days

    Sat 1 AugDay 22
    1. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public11:25 · SecurityOnline
    2. Ruby on Rails Patches Critical Vulnerability11:25 · SecurityWeek

  3. Quiet for 2 days

    Mon 3 AugDay 42
    1. Ruby on Rails fixes critical Active Storage bug CVE-2026-6606607:26 · Security Affairs
    2. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails19:21 · Rapid7

  4. Quiet for 4 weeks

    Mon 31 AugDay 321
    1. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution11:29 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in