Critical Rails Vulnerability Exposes Server Secrets via Image Uploads
A newly patched Ruby on Rails flaw allows unauthenticated attackers to read sensitive server files through malicious image uploads. The vulnerability impacts Active Storage and could leak encryption keys and credentials.
TL;DR
- CVE-2026-66066 is a critical Rails Active Storage flaw (CVSS 9.5) enabling unauthorized file reads.
- Attackers can exploit image upload functionality to access environment secrets without authentication.
- Impacted systems may expose secret_key_base, database passwords, and cloud storage credentials.
- Rails maintainers have released patches—organizations should update immediately.
- Applications using Active Storage with public upload endpoints are at highest risk.
Ruby on Rails has addressed a severe security vulnerability in its Active Storage component that could allow unauthenticated attackers to read arbitrary files from application servers. Tracked as CVE-2026-66066 and carrying a CVSS score of 9.5, the flaw poses significant risks to applications that accept public image uploads.
The vulnerability enables malicious actors to bypass authentication and access sensitive server-side information, including critical environment variables and cryptographic keys. Exploitation could lead to full exposure of application secrets such as secret_key_base, database credentials, and cloud storage tokens—potentially resulting in deeper system compromise or data leakage.
Technical Impact and Exploitation Path
- The flaw resides in how Active Storage processes image uploads, failing to properly restrict file access.
- Unauthenticated attackers can craft malicious requests to read files accessible to the Rails process.
- Sensitive data exposed includes environment variables, encryption keys, and infrastructure credentials.
- No user privileges or authentication are required to exploit this vulnerability.
Immediate Actions for Development Teams
- Upgrade Rails installations to the latest patched versions immediately.
- Audit logs for suspicious image upload activity or unexpected file access patterns.
- Rotate exposed secrets and API keys, especially those stored in environment variables.
- Restrict public access to Active Storage endpoints where not strictly necessary.
- Monitor for unusual outbound traffic that may indicate data exfiltration post-exploitation.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.