Rails security advisory (AV26-767)

Serial Number: AV26-767
Date: July 31, 2026

As of July 30, 2026, Rails is affected by a vulnerability in the following product:

• Rails
  • Prior to 8.0.5.1
  • Prior to 8.1.3.1
  • Prior to 7.2.3.2

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release 7.2.3.2 · rails/rails - GitHub
• Release 8.0.5.1 · rails/rails - GitHub
• Release 8.1.3.1 · rails/rails - GitHub
• [CVE-2026-66066] Possible arbitrary file read and remote code execution in Active Storage variant processing
• Release list - rails/rails