Rails 7.2.x Release Notes

Security Fixes

Active Storage

• CVE-2026-66066 - Disable all untrusted libvips formats.
  • This is a breaking change in any of these situations:
    • If you use libvips < 8.13 or ruby-vips < 2.2.1 this is not possible and Rails will refuse to start. As an emergency escape hatch we provide the RAILS_LTS_ALLOW_UNTRUSTED_VIPS_OPERATIONS=1 environment variable. This should only be used if you know that you don't process files from untrusted users, or when you have configured config.active_storage.variant_processor to use ImageMagick.
    • If your application processes complex file formats like SVG or PDF, ActiveStorage will no longer be able to do so. Formats can be selectively re-enabled (e.g. Vips.block('VipsForeignLoadPdf', false)). This may re-enable the vulnerability since it is not yet public which format enables the exploit.

Notes

• This release contains no functional change from the OSS Rails v7.2.3.1.

Security Fixes

Action View

• CVE-2026-33168 — Fix possible XSS vulnerability in tag helpers.

Active Storage

• CVE-2026-33658 - Fix possible DoS vulnerability in proxy mode via multi-range requests.
• CVE-2026-33202 — Fix possible glob injection in DiskService.
• CVE-2026-33195 — Fix possible path traversal in DiskService.
• CVE-2026-33174 - Fix possible DoS vulnerability in proxy mode via Range requests.
• CVE-2026-33173 — Fix insufficient filtering of metadata in direct uploads.

Active Support

• CVE-2026-33176 — Fix possible DoS vulnerability in number helpers.
• CVE-2026-33170 — Fix possible XSS vulnerability in SafeBuffer#%.
• CVE-2026-33169 — Fix possible ReDoS vulnerability in number_to_delimited.