Rapid7 publishes analysis of critical Ruby on Rails arbitrary file read and RCE vulnerability

Rapid7 has published an analysis of CVE-2026-66066, an arbitrary file read vulnerability in Ruby on Rails Active Storage when using the Vips image processor with untrusted uploads. The issue affects Active Storage versions before 7.2.3.2, 8.0.5.1, and 8.1.3.1, and can be chained to remote code execution.

Rapid7 reproduced the attack against Rails 6.0.6.1, 6.1.7.10, 7.2.3.1, 8.0.5, and 8.1.3, and confirmed that patched versions block the exploit. The chain exploits a mismatch between Rails’ content-type check and libvips’ file sniffing, allowing a crafted MAT/HDF5 file to be processed as an image and read arbitrary files.

Rapid7 also demonstrated an RCE path using JSON-compatible values in a signed variation key, which works when Rails is configured with the JSON message serializer.