Critical RCE in Ruby on Rails Active Storage (CVE‑2026‑66066) Enables File Disclosure & Remote Code Execution

Critical RCE in Ruby on Rails Active Storage (CVE‑2026‑66066) Enables File Disclosure & Remote Code Execution

What It Is – A newly disclosed vulnerability in Ruby on Rails Active Storage (CVE‑2026‑66066) allows an unauthenticated attacker to upload a crafted image, trigger unsafe libvips operations, and read arbitrary files from the server’s filesystem. The disclosed attack chain shows that environment variables (e.g., secret_key_base) can be exfiltrated, paving the way for remote code execution or lateral movement.

Exploitability – CVSS 9.5 (Critical). Public advisory, proof‑of‑concept image files released. No known widespread exploitation yet, but the attack requires only a single image upload to a vulnerable endpoint.

Affected Products – Ruby on Rails applications that use Active Storage with the libvips image processor (versions prior to the patch). Any web service that accepts untrusted image uploads and generates variants is at risk.

Why It Matters for Compliance & Audit Readiness

• Access‑control evidence – Exposure of secret_key_base and other credentials indicates a breakdown in logical access segregation; auditors will look for documented secret‑management controls.
• Patch‑management audit trail – Demonstrating timely remediation of high‑severity CVEs is a core SOC 2 CC‑6 (Change Management) requirement; continuous monitoring of third‑party libraries strengthens that evidence.
• Incident‑response readiness – The need to rotate secrets after a potential breach aligns with SOC 2 CC‑7 (Risk Management) expectations for documented post‑incident actions.

Recommended Actions

• Upgrade Rails Active Storage to the patched version and update libvips to ≥ 8.13.
• Rotate all secrets that may have been exposed: secret_key_base, encryption keys, cloud storage credentials, DB passwords, and third‑party tokens.
• Harden image‑upload pipelines – whitelist file types, enforce size limits, and disable unsafe libvips operations.
• Capture remediation evidence (patch logs, secret‑rotation records) in your continuous‑compliance platform to satisfy SOC 2 audit requirements.
• Review and update your SOC 2 access‑control policies to reflect the new secret‑management procedures.

Source: Security Affairs – Ruby on Rails Patches Critical Active Storage Vulnerability Affecting Image Processing