Short answer: A critical flaw in Ruby on Rails lets attackers upload images that can write files to the server. Apps using ImageMagick for image processing are affected. Upgrade to the latest Rails version and MiniMagick gem.
TL;DR
- Can write arbitrary files on the server.
- Can read any file the app can read.
- Upgrade to Rails 8.1.4.1 or 8.0.5.2.
- Ensure MiniMagick gem is up to date.
What is CVE-2026-66066?
This issue is a serious security vulnerability in Ruby on Rails where attackers can upload specially crafted images to write files to the server. It affects apps that use ImageMagick for image processing. The flaw can also allow attackers to read sensitive files, such as secret keys and credentials, which could lead to remote code execution. To protect against this, update to the latest version of Rails and ensure the MiniMagick gem is at the required version.
- RCE (remote code execution)
- An attacker can run their own commands on someone else's computer or server over the internet.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Credentials / secrets
- Passwords, keys and tokens that prove who you are to a system.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 04 Nov 2026 |
| CVE | CVE-2026-66066 |
| CVSS | 9.5 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-1188 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | github.com |
| Affected product | Rails |
| Published in NVD | 2026-07-30 (CVE-2026-66066) |
How it works
A flaw in Ruby on Rails allows attackers to upload a special file that can write and read server files.
- Attacker reaches the Rails over the internet / network
- No login or account is needed
- Sends crafted input that triggers the flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-07-30 | CVE-2026-66066 published in NVD | NVD |
| 2026-11-04 | Reported by The Hacker News | The Hacker News |
| 2026-11-09 | This Skillmate explainer published | Skillmate |
How to fix it
- Update Rails to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2026-66066 and upgrade to the fixed release it lists.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-66066 is a real NVD record scored 9.5 CRITICAL | CISA KEV does not list CVE-2026-66066 as exploited in the wild |
| Reported by The Hacker News | |
| Reported by github.com | |
| Reported by guides.rubyonrails.org | |
| Reported by rubyonrails.org |
Why it matters
Companies and users worldwide must update to fix this vulnerability to prevent unauthorized access and potential remote code execution.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is Active Storage?
Active Storage is a component in Ruby on Rails that handles file uploads and storage, including images and documents.
How can attackers exploit this flaw?
Attackers can upload a crafted file that uses ImageMagick to write arbitrary files on the server and read sensitive files.
Which versions of Rails are affected?
Rails versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected.
What should I do to protect my application?
Upgrade to Rails 8.1.4.1 or 8.0.5.2 and apply the ImageMagick security policy. Check your configuration and update dependencies.
Related Skillmate posts
Sources
- Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads (The Hacker News)
- Primary source / advisory (github.com)
- Vendor advisory CVE-2026-66066 (github.com)
- Rails (primary source) (guides.rubyonrails.org)
- Rails (primary source) (rubyonrails.org)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.