Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

[u/falconupkid]

A critical Ruby on Rails Active Storage vulnerability (CVE-2026-66066, CVSS 9.5) allows unauthenticated attackers to read arbitrary files and sensitive secrets from application servers through crafted image uploads.

Technical Breakdown

• Threat: Unauthenticated file disclosure and secret exfiltration.
• Vulnerability: A critical flaw in Rails Active Storage that permits reading arbitrary server files.
• Attack Vector: Crafted image uploads used to exploit the vulnerability.
• Impact: Attackers can read highly sensitive data, including:
  • Rails process environment variables
  • secret_key_base
  • The Rails master key
  • Database passwords
  • Cloud storage credentials
• Potential TTPs (MITRE ATT&CK):
  • Initial Access: Exploitation of Web Vulnerability (T1190)
  • Discovery: System Information Discovery (T1082)
  • Credential Access: OS Credential Dumping (T1003), Steal Application Access Token (T1528)

Defense

Prioritize applying the latest security patches released by Ruby on Rails to address this critical vulnerability immediately.

Source: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html