Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Rails Active Storage mitigation guidance for CVE-2026-66066

Advisory/Mitigation
First reported
Last updated
Happening score
H score 40
1 unique sources, 1 articles

Summary

Hide ▲

Rails maintainers issued mitigation guidance for CVE-2026-66066, directing Active Storage operators to upgrade to libvips 8.13 or later and rotate secrets after the flaw enabled arbitrary file read and possible RCE. The guidance applies to apps that process untrusted image uploads with libvips, where a crafted image can expose application files and environment secrets. Administrators on supported systems can also block the vulnerable path with VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true). Rails says there is no workaround for deployments using libvips before 8.13.

Related Happenings

Rails maintainers security patch release for CVE-2026-66066

Security Patch Release
H score40 First: 01.08.2026 17:20 Last: 01.08.2026 17:20 Sources 1

How related: Rails maintainers published an advisory about the CVE-2026-66066 flaw, which received a critical severity rating.

About this happening: Rails published an advisory and version guidance for CVE-2026-66066, a critical Active Storage flaw affecting specific release lines and requiring upgrades. The patch...

Open Happening

Rails Active Storage arbitrary file read and RCE flaw (CVE-2026-66066)

Vulnerability
H score37 First: 01.08.2026 17:20 Last: 01.08.2026 17:20 Sources 1

How related: A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE).

About this happening: CVE-2026-66066 leaves Rails Active Storage vulnerable to arbitrary file read and possible RCE when libvips handles untrusted image uploads. The flaw affects ...

Open Happening

Arista VeloCloud Orchestrator security update for CVE-2026-16812

Security Patch Release
H score55 First: 28.07.2026 01:49 Last: 28.07.2026 01:49 Sources 1

About this happening: Arista patched CVE-2026-16812, a maximum-severity 10.0 OS command injection flaw in on-premises VeloCloud Orchestrator (VCO), after confirming it is actively...

Open Happening

RabbitMQ maintainers security patch release for CVE-2026-57219

Security Patch Release
H score29 First: 14.07.2026 16:48 Last: 14.07.2026 16:48 Sources 1

About this happening: RabbitMQ maintainers released fixed versions for multiple supported release lines, closing two access-control flaws that could expose OAuth client secrets and cross-te...

Open Happening

Progress Kemp LoadMaster pre-auth command injection (CVE-2026-8037)

Vulnerability
H score49 First: 30.06.2026 10:38 Last: 30.06.2026 10:38 Sources 1

About this happening: CVE-2026-8037 gives Progress Kemp LoadMaster with the API enabled a pre-auth command injection path that can run root commands on affected appliances. A patc...

Open Happening

Timeline

  1. 01.08.2026 17:20 2 articles · 2h ago

    Rails directs Active Storage operators to upgrade libvips and rotate exposed secrets

    Mitigation Patch Update

    Rails maintainers issued mitigation guidance for CVE-2026-66066 affecting Active Storage deployments that process untrusted image uploads with libvips, warning that a specially crafted image can expose arbitrary files and secrets on the server. The guidance calls for upgrading to libvips 8.13 or later, rotating secret_key_base, database credentials, Active Storage service credentials, and other process secrets, and temporarily blocking the vulnerable path with VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true) on supported systems; Rails says there is no workaround for apps using libvips before 8.13.

    Show sources
    Open in new tab