Rails libvips bug (CVE‑2026‑66066) lets attackers read files and trigger RCE
A new CVSS 9.5 vulnerability (CVE‑2026‑66066) in Rails 7+ Active Storage lets unauthenticated users upload crafted images that abuse unfuzzed libvips operations to read arbitrary files and, by chaining, achieve remote code execution. Rapid7 and the Rails security team urge immediate remediation as proof‑of‑concept code has already been released.