CVE-2026-66066: Active Storage LFI – What’s Your Patch Strategy?
Just caught wind of CVE-2026-66066 and the CVSS 9.5 score is no joke. The idea that an unauthenticated attacker can read arbitrary files just by uploading a manipulated image is nightmare fuel, especially for apps relying heavily on Active Storage for user avatars or documents.
From the early reports, the issue stems from how Active Storage processes image variants. The vulnerability allows a threat actor to craft a specific image payload that exploits the underlying image processor, potentially leading to Local File Inclusion (LFI). We're talking about exposure of critical secrets like secret_key_base, database credentials, and cloud storage keys.
I’m currently auditing our Rails fleet. If you're in the same boat, you might want to check if your image_processing gem is up to date alongside the Rails patch. Here's a quick command to find Rails instances that might be leveraging Active Storage:
# Find Rails apps with active_storage in the Gemfile
find . -name "Gemfile.lock" -exec grep -l "active_storage" {} \;
I know the official fix is to upgrade to the latest Rails version, but for large legacy monoliths, that's not an instant flip. Are you seeing any success with proxy-based mitigation (like stripping EXIF data at the reverse proxy layer), or is the consensus that we just have to bite the bullet and patch?
Has anyone managed to reproduce this locally yet?
We just patched, but for the 24-hour window before deployment, we deployed a ModSecurity rule to block any uploads containing non-standard TIFF/JP2 headers that were hinted at in the disclosure. It's noisy, but better safe than sorry. Also, ensure your credentials.yml.enc isn't world-readable just as a baseline hardening measure.
# Check file permissions on credentials
ls -la config/credentials.yml.enc
The exploit chain relies on the image processor (ImageMagick/Vips) handling file paths incorrectly based on metadata. If you can't upgrade Rails immediately, consider disabling the variant call for user-generated content until you can. It breaks dynamic resizing, but it kills the vector.
# Temporary disable variant processing
# image.variant(resize_to_limit: [100, 100])
Just saw a spike in 400 Bad Requests on our upload endpoints—likely scanners looking for this. I'm pulling logs for anything attempting to upload images with suspiciously long filenames or path traversal characters in the headers.
grep "ActiveStorage" production.log | grep "\.\./"
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access