[DigitalToday reporter Chi-gyu Hwang] Ruby on Rails, a Ruby-based web development framework, has released a patch this week for a serious vulnerability that could allow even an unauthenticated attacker to carry out remote code execution, SecurityWeek reported on Friday local time.

The report said the flaw, registered as CVE-2026-66066 and rated 9.5 on the CVSS scale, is an arbitrary file read vulnerability. It can expose secret information and allow remote attackers to execute code and move laterally to other systems.

Ruby on Rails administrators said in a security advisory that, under default settings, an unauthenticated attacker can read arbitrary files on the server when a Rails application displays image variants. This includes process environment variables. The advisory explained that an attacker could find secret_key_base and credentials for external systems in exposed environment variables and use them to escalate the attack to the level of RCE.

CVE-2026-66066 was patched in Active Storage versions 7.2.3.2, 8.0.5.1 and 8.1.3.1. Administrators advised users to update their distributions immediately and raise libvips to at least version 8.13. Ruby on Rails said an update can block the vulnerability itself but cannot reverse secret information that has already been leaked, and urged affected applications to treat all secret information readable by the process as exposed and replace it.

Rapid7 said that as of July 30 there were no confirmed cases of the vulnerability being exploited in real-world attacks.