Vulnerability

CERT-In Vulnerability Note CIVN-2026-0393
Arbitrary file read Vulnerability in Ruby on Rails Active Storage

Original Issue Date:August 05, 2026

Severity Rating: CRITICAL

Software Affected

Rails version prior to 7.2.3.2
Rails version 8.0.0 or higher and prior to 8.0.5.1
Rails version 8.1.0 or higher and prior to 8.1.3.1

Overview

A vulnerability has been reported in Ruby on Rails Active Storage which could allow an unauthenticated remote attacker to read arbitrary files from the server and subsequently perform Remote Code Execution (RCE).

Target Audience:
All organizations and individuals using Ruby on Rails Active Storage with the libvips library enabled.

Risk Assessment:
High risk of unauthorized disclosure of sensitive files, secrets, and credentials, potentially leading to Remote Code Execution (RCE) and complete system compromise.

Impact Assessment:
High impact on Confidentiality, Integrity and Availability of the system.

Description

Ruby on Rails is a server-side web application framework written in Ruby. Active Storage is the Rails component used to upload, store, and process files.

This vulnerability exists Ruby on Rails because active Storage does not disable libvips operations that are considered unsafe when processing untrusted content. An unauthenticated remote attacker can exploit this vulnerability by uploading specially crafted image files.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files from the server. Exposure of sensitive information may subsequently lead to Remote Code Execution.

Solution

Apply appropriate Updates and steps as mentioned by the vendor:
https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm

Vendor Information

https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm

References

https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm

CVE Name
CVE-2026-66066

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India