Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Critical Security Flaw in Ruby on Rails Could Expose Your Files via Image Uploads

A serious security weakness has been found in certain versions of Ruby on Rails, a popular web framework. This flaw could let attackers access sensitive files on your server through specially crafted image uploads, potentially exposing passwords and secret keys. It is important for organisations using affected versions to update promptly to avoid risks.

31 July 2026

Reference: CVE-2026-66066

1. What is being reported?

The vulnerability involves a component called Active Storage in Ruby on Rails that handles image uploads. In some versions, unsafe operations in an image processing library (libvips) are not properly blocked. This means an attacker can upload a malicious image that tricks the system into revealing files it should keep private, including secret credentials.

2. What this means in plain English

If your website or application uses the affected versions of Ruby on Rails and allows image uploads from users you do not fully trust, an attacker could read confidential files on your server. This might let them steal passwords or other secrets, which could lead to further attacks like taking control of your system or accessing other connected services.

3. Could this affect a small business?

Small businesses or organisations using Ruby on Rails for their websites or apps that accept image uploads from the public could be at risk if they have not updated to the fixed versions. If you do not use Ruby on Rails or do not allow image uploads from untrusted users, this vulnerability likely does not affect you.

4. What to do now

  • Check if your website or application uses Ruby on Rails versions before 7.2.3.2, 8.0.5.1, or 8.1.3.1.
  • If you do, ask your IT provider or software supplier to update Ruby on Rails to one of the fixed versions immediately.
  • Review your image upload settings to ensure only trusted users can upload files, if possible.
  • Monitor your systems for unusual activity and ensure backups are up to date in case of an incident.

5. Ask your IT provider

Can you confirm whether our Ruby on Rails installation is affected by CVE-2026-66066 and if it has been updated to a secure version?

6. Bottom line

Update Ruby on Rails promptly if you accept image uploads to prevent attackers from accessing sensitive files.

Information based on CISA KEV, NVD and reputable security reporting.

Back to Vulnerability Briefs