Ruby on Rails Active Storage File Read (CVE-2026-66066): Exposure and Response

Exposure conditions

CVE-2026-66066 affects specific Active Storage branches when Rails uses libvips for variants and an untrusted user can trigger image processing. A crafted upload can reach an unfuzzed loader and read files available to the application process. If those files expose secret_key_base or service credentials, the impact can extend beyond the original image request.

Affected branches

The official advisory lists Active Storage before 7.2.3.2, 8.0 before 8.0.5.1 and 8.1 before 8.1.3.1. Check the deployed Gemfile.lock, the runtime variant processor and every feature that automatically creates thumbnails or previews from untrusted uploads.

libvips boundary

The crafted file can invoke MATLAB/HDF5 external-file behavior through libvips. Rails recommends patched Active Storage and libvips 8.13 or later. Supported deployments can block untrusted loaders through VIPS_BLOCK_UNTRUSTED or ruby-vips 2.2.1 and Vips.block_untrusted(true). Test approved formats and background jobs before rollout.

Official forensic tooling

The Rails security team published rails-forensics-CVE-2026-66066 to estimate the vulnerable window and search Active Storage metadata and object storage. Preserve object keys, timestamps, hashes, request logs and job-queue records before deletion or re-encoding. Correlate suspicious uploads with variant jobs and result downloads.

Secret rotation

After patching, rotate secret_key_base, Rails credentials and database, object-storage, email, OAuth and payment credentials readable by the process. Issue replacements first, migrate dependencies, revoke old values and invalidate sessions or signed cookies where appropriate.

Validation

1. Verify the fixed Active Storage branch.
2. Verify libvips 8.13 or later and loader blocking.
3. Test approved uploads, variants, storage and CDN delivery.
4. Correlate forensic-tool output with web, job and storage logs.
5. Record secret rotation and revocation timestamps.

Keep the lockfile, container image identifier, libvips version, regression evidence and forensic search scope with the change record so remediation, service validation and retrospective review remain linked.