A crafted image upload can turn Active Storage into a file reader. The break is not an image crash; it is secret exposure from whatever the Rails process is allowed to see, which patching alone does not undo if those secrets were already taken.
Rails fixed CVE-2026-66066 in Active Storage, which affects apps using libvips for image processing and accepting untrusted uploads. The issue can expose environment data, secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens; Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 are the fixed releases, and 7.0 and 7.1 users must move to 7.2.3.2 or later.
The practical risk is broader than the upload path itself. If the application can read a secret, that secret can open databases, cloud storage, or connected systems, and the same trust-boundary flaw can exist anywhere untrusted uploads are handed to shared image libraries.