Arbitrary file read and RCE in Rails Active Storage variant processing (CVE-2026-66066)

Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation during variant processing. An unauthenticated attacker can exploit this to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. Public POC available. Affected versions: - < 7.2.3.2 - >= 8.0, < 8.0.5.1 - >= 8.1, < 8.1.3.1 We recommend updating to: 7.2.3.2, 8.0.5.1, 8.1.3.1. CVSS 9.5 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/324 Details: https://vuln.today/cve/CVE-2026-66066