Ruby on Rails Security Update Advisory (CVE-2026-66066)

Overview

A security update has been released to address a vulnerability in Ruby on Rails. This affects products that use Active Storage, and users should update to the latest version.

Vulnerability Information

• CVE-2026-66066: This vulnerability was discovered in Ruby on Rails Active Storage (a feature that handles attached resources such as images and files).
• The vulnerability could lead to remote code execution due to arbitrary file reading occurring during the image transformation process.

Affected Versions

• Active Storage versions prior to 7.2.3.2.
• Active Storage versions 8.0 Or higher but lower than 8.0.5.1.
• Active Storage versions 8.1 Or higher but lower than 8.1.3.1.

Fixed Versions

• Active Storage versions 7.2.3.2 Or higher.
• Active Storage version 8.0.5.1 Or later.
• Active Storage version 8.1.3.1 Or later.

Action

Instructions were provided to update to the latest version with the Vulnerability Patch, following the guidance on the reference site.