In a nutshell: The Rails security vulnerability CVE-2026-66066 with CVSS score 9.5 allows unauthenticated attackers to read sensitive data such as secrets and database credentials via Active Storage.
Ruby on Rails has released patches for a critical security vulnerability in Active Storage that allows unauthenticated attackers to read arbitrary files from application servers through manipulated image uploads.
The security vulnerability is designated CVE-2026-66066 and is classified as critical with a CVSS score of 9.5. It is located in the Active Storage component of Ruby on Rails, which is responsible for managing file uploads. Through manipulated image uploads, unauthenticated attackers can read arbitrary files from the server.
Potentially exposed data includes sensitive configuration information of the Rails process, including the secret_key_base, the Rails master key, database passwords, and credentials for cloud storage services. This information represents targets of the highest priority for attackers, as it enables access to entire application infrastructures and backend systems.
CTOs should immediately update Rails installations with Active Storage to the available patches. The vulnerability affects the processing of uploaded files without sufficient validation of paths, which enables attackers to perform directory traversal to gain read access to arbitrary system files.
Source: thehackernews.com · Published 29 July 2026
Lumi AI News — AI-assisted curation according to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.