Ruby on Rails released patches for a critical flaw in Active Storage that exposes servers to unauthenticated file disclosure attacks. The vulnerability, tracked as CVE-2026-66066 with a CVSS score of 9.5, allows attackers to read arbitrary files from application servers by uploading crafted images.
The attack requires no authentication. An attacker simply sends a malicious image file to trigger path traversal logic within Rails' image processing pipeline. Once exploited, the vulnerability exposes the Rails process environment and sensitive secrets including secret_key_base (the Rails master key), database passwords, and cloud storage credentials.
The exposure of these secrets creates cascading risks. Attackers obtaining database passwords gain direct access to application data. Cloud storage credentials enable theft of files stored in S3, Google Cloud Storage, or Azure Blob Storage. The Rails master key itself can decrypt all encrypted credentials stored in the application.
Any organization running vulnerable versions of Ruby on Rails with Active Storage enabled faces risk. This includes applications that accept image uploads from users, even those implementing basic file type validation. The vulnerability exists in the image processing logic before validation occurs in many configurations.
Rails maintainers released patches across multiple versions. Developers should immediately update to patched releases and rotate all exposed secrets including database passwords, API keys, and cloud credentials. Organizations should audit logs for suspicious image upload requests and review file access patterns.
The high CVSS score reflects the combination of unauthenticated access, zero user interaction required, and the sensitivity of exposed secrets. Active Storage handles file uploads for numerous Rails applications, making this vulnerability broadly exploitable across the ecosystem.