RUBY on Rails has addressed a critical vulnerability (CVE-2026-66066) in its Active Storage framework that could allow unauthenticated attackers to read arbitrary files from servers, impacting applications that use the libvips image processor. This vulnerability has a CVSS score of 9.5 and poses significant risks, including remote code execution.
Organizations are advised to apply the security patches immediately, which involve upgrading Active Storage, updating libvips to version 8.13 or later, and rotating any exposed application secrets. If attackers have already accessed these secrets, they should be considered compromised, necessitating a full rotation of sensitive credentials like `secret_key_base` and database passwords. The advisory emphasizes that older versions of libvips cannot adequately mitigate this risk.