🔴 Critical | Source: The Hacker News
A critical vulnerability (CVE-2026-66066, CVSS 9.5) in Ruby on Rails’ Active Storage component allows unauthenticated attackers to read arbitrary files from the server by uploading specially crafted images. Sensitive data exposed includes secret keys, master keys, database credentials, and cloud storage secrets. Rails has released patches and immediate upgrade is strongly advised.
Security Architect’s Take: Audit all Rails applications using Active Storage and apply the vendor patch immediately; in the interim, consider blocking image upload endpoints at the WAF or API gateway layer and rotate any potentially exposed credentials — including cloud storage keys and database passwords — on affected systems.
Original advisory: Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads