Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

The article reports a critical Ruby on Rails Active Storage vulnerability (CVE-2026-66066, CVSS 9.5) that allows unauthenticated attackers to read arbitrary server files via crafted image uploads in apps using libvips, exposing environment data and secrets such as secret_key_base, master key, database passwords, cloud storage credentials, and API tokens.[1][2] These leaked secrets can then be used to achieve remote code execution or lateral movement across connected systems.[1][4] From a RealGround perspective, any AI-enabled Rails application (or AI agents backed by such apps) is at substantial risk of downstream data leakage and compromise of model secrets, API keys, and storage backends if this flaw is unpatched. Organizations should urgently apply the Rails fixes, rotate all exposed secrets, and include this class of storage-layer vulnerabilities in AI security readiness assessments, continuous red teaming of AI-facing endpoints, and secure agent build reviews to ensure file upload and storage integrations do not become indirect data exfiltration paths.[1]