Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

A critical vulnerability (CVE-2026-66066, CVSS 9.5) in Ruby on Rails' Active Storage component, using libvips for image processing, allows unauthenticated attackers to read arbitrary files from application servers. This is due to a flaw in how libvips handles untrusted image uploads. Affected versions of Rails (7.0.0 - 7.2.3.1, 8.0.0 - 8.0.5, and 8.1.0 - 8.1.3) require immediate patching to mitigate the risk of exposing sensitive data, including secret keys and credentials. No active exploitation has been reported at the time of publication.