Threat Intelligence Brief
Curated summary with source attribution
Source: bleepingcomputer.com
Threat Risk: High
Victim: Ruby on Rails applications using Active Storage with libvips
Incident: A critical vulnerability (CVE-2026-66066) enables arbitrary file read and potential RCE via crafted image uploads.
Impact: Full system compromise and exposure of sensitive application credentials.
Attacker: Unidentified threat actors
Analysis: The vulnerability arises from how Active Storage processes images using libvips, enabling attackers to read arbitrary files from the server. By accessing the ‘secret_key_base’, threat actors can forge session cookies and escalate the attack to remote code execution. The availability of public proof-of-concept exploits significantly increases the likelihood of widespread targeting.
Recommendations: Update Rails and libvips to the latest patched versions immediately.; Rotate the ‘secret_key_base’ and all associated database and cloud credentials.; Set the VIPS_BLOCK_UNTRUSTED environment variable to mitigate risk on supported systems.
Source: Bleeping Computer
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source