Critical Vulnerability in Active Storage: Arbitrary File Read and Remote Code Execution
A critical vulnerability (CVE-2026-66066) has been discovered in Active Storage, a popular Ruby on Rails component, which allows unauthenticated attackers to read arbitrary files from the server and potentially achieve remote code execution. The vulnerability has a CVSS score of 9.5 and affects applications using libvips for image processing and allowing image uploads from untrusted users. Immediate mitigation steps include upgrading to a fixed version of Active Storage, updating libvips to version 8.13 or higher, and changing sensitive secrets.