Critical Ruby on Rails CVE-2023-38037 Flaw Allows Remote Code Execution

Key Takeaways

• A critical remote code execution (RCE) flaw, CVE-2026-66066, has been discovered in Ruby on Rails Active Storage.
• The vulnerability impacts applications utilizing libvips for image variant processing and accepting uploads from unauthenticated users.
• Successful exploitation can lead to arbitrary file reads, exposing sensitive data like API keys, database credentials, and cloud secrets, potentially escalating to full RCE.
• Patches are available across multiple Active Storage versions, with libvips version 8.13 or newer required for full mitigation.
• Immediate action includes upgrading affected Active Storage versions, updating libvips, and rotating all potentially exposed secrets.

A severe security vulnerability, identified as CVE-2026-66066, has emerged within Ruby on Rails Active Storage. This critical flaw could enable unauthenticated attackers to retrieve sensitive files from affected servers and potentially achieve remote code execution. The vulnerability poses a significant risk to applications that process image variants via libvips and permit file uploads from untrusted sources, potentially exposing crucial secrets such as secret_key_base, cloud credentials, and database passwords.

Understanding the Vulnerability

The core of the issue lies in how libvips, a popular image processing library, handles certain file formats when generating image variants within a default Rails setup. Libvips utilizes various third-party libraries for processing different formats, categorizing some of these operations as “unfuzzed” – meaning they are deemed unsafe for untrusted content. Active Storage, in its default configuration, did not adequately disable these unfuzzed operations, making it susceptible to malicious uploads.

Specifically, an attacker could upload a specially crafted file. When Active Storage attempts to generate a variant of this file, the underlying libvips process can be coerced into invoking one of these “unfuzzed” operations. Researchers have successfully demonstrated an attack chain that leads to the disclosure of arbitrary files accessible by the application process. This often includes critical system environment variables, where sensitive information like secret_key_base and credentials for external systems are commonly stored, thereby creating a pathway for remote code execution or lateral movement into interconnected services.

Affected Systems and Mitigation

Applications are vulnerable if they configure Active Storage to use libvips for image processing (typically via config.active_storage.variant_processor = :vips, which has been the default since Rails 7.0) and allow untrusted users to upload images. It’s important to note that merely enabling variant generation is not a separate requirement for exposure; the presence of the configuration and untrusted uploads is sufficient.

Vulnerable Active Storage package ranges include versions below 7.2.3.2, 8.0.x below 8.0.5.1, and 8.1.x below 8.1.3.1. Patched releases are now available through standard Rails distribution channels. Furthermore, to fully secure the environment, the minimum supported libvips version is 8.13 or later. Older libvips builds lack the capability to disable unfuzzed operations, and Active Storage will intentionally raise an exception during boot in such an unsecurable environment.

Administrators must prioritize upgrading their Active Storage installations to a fixed release and ensuring that libvips is at least version 8.13. While patching prevents future exploitation, it does not mitigate secrets that may have already been compromised. Therefore, any secret accessible by the application process should be considered potentially exposed and immediately rotated. This includes secret_key_base, the master key (from config/master.key or RAILS_MASTER_KEY), all data decrypted from config/credentials.yml.enc, Active Storage service keys for cloud providers like S3, GCS, or Azure, database credentials, and tokens for third-party APIs.

It’s crucial to understand the implications of rotating secret_key_base, as it will invalidate active user sessions, forcing re-authentication. Encrypted and signed cookies, signed global IDs, and Active Storage URLs will also be affected. Any rotated secret should not be retained as a fallback. For scenarios where an immediate Rails upgrade isn’t feasible, temporary workarounds exist. For libvips 8.13 or newer, setting the VIPS_BLOCK_UNTRUSTED environment variable will block untrusted operations during libvips initialization. Applications using ruby-vips 2.2.1 or later can alternatively invoke Vips.block_untrusted(true) from an initializer. However, for libvips versions older than 8.13, the only safe workaround is to remove the libvips dependency entirely, such as by removing ruby-vips from the Gemfile if its use is limited to image analysis or if Active Storage is not in use.

The technical specifics of the attack chain have been intentionally withheld to allow organizations to focus on patching without providing attackers with an immediate exploit playbook. Full disclosure is anticipated no later than August 28, 2026, via the Rails Security Announcements forum. The vulnerability was responsibly reported by 0xacb, s3np41k1r1t0, and castilho from Ethiack, along with RyotaK from GMO Flatt Security Inc.

What You Should Do

• Upgrade Active Storage: Immediately update your Active Storage gem to a patched version: 7.2.3.2 or later, 8.0.5.1 or later (for 8.0.x branch), or 8.1.3.1 or later (for 8.1.x branch).
• Update libvips: Ensure your libvips installation is version 8.13 or newer. Older versions cannot effectively mitigate this vulnerability.
• Rotate All Secrets: Treat all secrets accessible by the application process as potentially compromised. This includes secret_key_base, RAILS_MASTER_KEY, database credentials, cloud service keys (S3, GCS, Azure), and third-party API tokens.
• Implement Workarounds (if immediate upgrade is not possible):
  • For libvips 8.13+: Set the VIPS_BLOCK_UNTRUSTED=1 environment variable.
  • For ruby-vips 2.2.1+: Call Vips.block_untrusted(true) from an initializer.
  • For libvips older than 8.13: Remove the libvips dependency from your application entirely.
• Review Upload Policies: Verify that your application’s policies for handling untrusted user uploads are robust and that image processing operations are secured against known vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.