CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
If your Rails app lets people upload a profile picture, CVE-2026-66066 matters to you today. The Ethiack research team found a way to disguise a file so it reads as two different formats to two different libraries at once — and the mismatch lets an unauthenticated attacker pull arbitrary files off your server. No login, no secret_key_base, no forged signature required. Rails patched it on July 29, 2026.
How a fake MATLAB file becomes a file-read bug
The trick is format confusion. A crafted file identifies itself to libvips as a MATLAB level-5 file, but to libmatio — the library libvips hands MATLAB files off to — it actually parses as a MAT 7.3 file, which under the hood is just an HDF5 container. HDF5 has a legitimate feature called an External File List, meant to let one HDF5 file reference data stored in another file on disk. Nothing stops that referenced path from pointing wherever the attacker wants.
Upload that file as an "image," let Active Storage process it into a variant, and libvips will happily read whatever file the External File List points at — config/master.key, .env, an SSH private key, anything the Rails process can read — and the resulting error message or processed output can leak that content back out. From there it's a short hop to secret_key_base, and a leaked secret_key_base on a Rails app is close to game over: it's the key that signs cookies and session data, and forging a signed object with it is a well-worn path to remote code execution.
Affected versions vs. fixed versions
Rails 7.0.0 – 7.2.3.1
Fixed in
7.2.3.2
Rails 8.0.0 – 8.0.5
Fixed in
8.0.5.1
Rails 8.1.0 – 8.1.3
Fixed in
8.1.3.1
Rails 6.0.0 – 6.1.7.10 (non-default Active Storage setup only)
Fixed in
Upgrade libvips + apply the equivalent Active Storage patch
Fixed in
Rails 7.0.0 – 7.2.3.1
7.2.3.2
Rails 8.0.0 – 8.0.5
8.0.5.1
Rails 8.1.0 – 8.1.3
8.1.3.1
Rails 6.0.0 – 6.1.7.10 (non-default Active Storage setup only)
Upgrade libvips + apply the equivalent Active Storage patch
Who's actually exposed
Your app uses Active Storage's image variant processing (not just file storage — the image transformation path specifically).
libvips is the processing backend and it's older than 8.13, or ruby-vips is older than 2.2.1.
The app accepts image uploads from users you don't fully trust — which, for any public-facing app with avatars or attachments, is everyone.
Active Storage's image pipeline runs on every upload — which is exactly why a format-confusion bug here has such a wide blast radius. · Unsplash
The fix, in full
Upgrade Rails to 7.2.3.2, 8.0.5.1, or 8.1.3.1 depending on your track.
Separately confirm libvips is 8.13 or later — the Rails patch alone does not fix an outdated libvips install.
Bump ruby-vips to 2.2.1 or later so the mitigation code path is actually available.
If you can't patch immediately, set the `VIPS_BLOCK_UNTRUSTED` environment variable as a stopgap — not a substitute for the real fix.
If you can't rule out prior exploitation, rotate `secret_key_base`, the Rails master key, and any service credentials the app process could read.
KindaRails2Shell, quickly
Do I need to be logged in to exploit this?
No. It's pre-authentication — any public upload form that feeds Active Storage's image processing is in scope.
Is updating Rails alone enough?
No. You also need libvips 8.13+ and ruby-vips 2.2.1+. Updating one without the other leaves the gap open.
Is this being exploited right now?
Rapid7 said it wasn't aware of in-the-wild exploitation as of July 30, 2026, but public proof-of-concept code appeared within two days of disclosure — treat that window as closed.
What's the actual worst case?
Arbitrary file read on its own can leak secret_key_base. Once an attacker has that, they can forge signed cookies and other serialized data, which is a documented path to remote code execution on Rails apps.
This is the same shape of bug we've flagged twice already this summer — JetBrains TeamCity's unauthenticated RCE and Gitea's diff/patch git-hook RCE both start from something a normal user is allowed to submit — a build config, a diff, an image — and end with code execution because a trusted format parser trusted too much. If your stack touches user-uploaded images anywhere near Active Storage, check your libvips version before you do anything else today.
