Impact
CVE-2026-66066 affects Rails Active Storage branches below 7.2.3.2, 8.0.5.1, and 8.1.3.1. The issue can allow arbitrary file reads with potential follow-on remote code execution when the vulnerable processing path and unsafe image-processing configuration are both reachable. This article does not treat RCE as guaranteed.
Root Cause
Active Storage processes uploaded media through image-processing backends. The vulnerability involves unsafe processing behavior for untrusted content. The exact impact depends on the deployed Rails branch, processing backend, application configuration, and whether untrusted uploads can reach the relevant variant path.
How FixVibe covers it
FixVibe's GitHub repository scans flag Rails apps whose Gemfile.lock resolves an affected activestorage version, and show the version and file to upgrade.
Remediation
Upgrade activestorage to the branch-appropriate fixed release: 7.2.3.2, 8.0.5.1, or 8.1.3.1, as applicable, then rebuild and redeploy. Keep libvips at 8.13 or later and review image-processing configuration and upload controls. If exposure is suspected, rotate potentially exposed secrets and verify the deployed endpoint and runtime configuration through trusted operational access.
Sources: [S1] Rails upstream reviewed advisory; [S2] GitHub reviewed advisory; [S3] NVD.