Critical Ruby on Rails Flaw Allows Unauthenticated File Reads via Image Uploads
A critical vulnerability in Ruby on Rails' Active Storage component, CVE-2026-66066, allows unauthenticated attackers to read sensitive server files by uploading crafted images.
Ruby on Rails has issued urgent patches for a critical vulnerability, CVE-2026-66066, affecting its Active Storage component. This flaw, with a severe CVSS score of 9.5, enables unauthenticated attackers to read arbitrary files from application servers by exploiting a weakness in image processing. The vulnerability could expose highly sensitive information, including the Rails process environment, secret keys, database passwords, and cloud storage credentials, potentially leading to remote code execution or lateral movement within compromised networks.
The vulnerability specifically impacts applications that utilize the libvips library for Active Storage image processing and accept image uploads from untrusted users. According to researchers from Ethiack and GMO Flatt Security, affected versions include Rails 7.0.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. While Rails 6.0.0 through 6.1.7.10 are also vulnerable, this is only if Active Storage is configured to use Vips, as it was not the default processor in those earlier versions. The official advisory broadens the affected range to activestorage < 7.2.3.2, with practical exploitation paths identified from Rails 6.0 onwards when using Vips.
Applications running on Rails 7.0 and 7.1, which are now end-of-life, are particularly at risk as they will not receive direct fixes and must upgrade to Rails 7.2.3.2 or later. For other affected versions, developers are urged to upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1. Crucially, organizations must also rotate any secrets that could have been read by the application process. The security update also requires libvips version 8.13 or later, and if ruby-vips is installed, version 2.2.1 or later.
As of the disclosure, neither research team had released a proof-of-concept (PoC) exploit, and initial searches of public exploit repositories showed no immediate public availability. However, Rails has cautioned that applying the patch does not invalidate credentials that may have already been compromised. The vulnerability lies in the interaction between Active Storage and libvips, where Active Storage failed to properly block potentially unsafe operations invoked by libvips, some of which are backed by third-party libraries and considered untrusted.
Exploiting this flaw grants attackers an arbitrary file-read capability. The subsequent impact, such as achieving code execution or moving laterally within a network, depends entirely on the sensitive data extracted and the access those credentials provide. To mitigate this, Rails strongly advises rotating critical secrets including secret_key_base, the master key, decrypted credentials, database credentials, Active Storage service keys, and any third-party API tokens.
As a temporary mitigation for those unable to immediately update Rails, the VIPS_BLOCK_UNTRUSTED environment variable can be set when running libvips 8.13 or later. Alternatively, developers can call Vips.block_untrusted(true) directly with ruby-vips 2.2.1 or later. For older libvips versions that cannot enforce this blocking, upgrading libvips or removing it entirely from the application is necessary.
The vulnerability was independently reported by André Baptista, Bruno Mendes, and Rafael Castilho of Ethiack, and RyotaK of GMO Flatt Security. While the specific attack chain and malicious file formats remain undisclosed by the researchers, Rails has committed to releasing further technical details by August 28, 2026. At the time of reporting, there was no indication of active exploitation in the wild, and the CVE was not yet listed on CISA's Known Exploited Vulnerabilities catalog.
The new article provides further technical details on the exploitation chain, highlighting that the vulnerability arises from libvips processing untrusted image uploads via unsafe "unfuzzed" operations. It also specifies the affected versions of Active Storage and the minimum required libvips version for security, along with mitigation strategies beyond immediate patching.
The advisory for CVE-2026-66066, "KindaRails2Shell," details a critical vulnerability in Ruby on Rails' Active Storage component, specifically when utilizing the libvips library for image processing. This flaw, rated with a CVSSv4 score of 9.5, allows unauthenticated attackers to read arbitrary files accessible to the application process, potentially leading to remote code execution by exposing sensitive secrets. While Rapid7 is not aware of in-the-wild exploitation, the vulnerability affects Rails 7.0+ applications configured with the default Vips processor, and patches are available for Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1, provided libvips is updated to version 8.13 or later.
The newly released patches for Ruby on Rails address CVE-2026-66066, a critical vulnerability with a CVSS score of 9.5 that allows unauthenticated attackers to read arbitrary files, potentially exposing secrets like the secret_key_base and credentials. While the initial advisory noted no evidence of in-the-wild exploitation as of July 30, the fix is crucial for applications using Active Storage with the libvips library for image processing, as crafted file uploads could invoke unsafe operations. Affected applications should treat all readable secrets as potentially compromised and change them, alongside updating to patched Active Storage versions and libvips 8.13 or later.
The vulnerability, CVE-2026-66066, specifically impacts Active Storage versions prior to 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1, and is exploitable when the libvips image processing library is in use. While Rails 6.x is only affected if Active Storage is configured outside its defaults, the maintainers have also noted that public proof-of-concept exploits have rapidly become available, prompting the immediate release of full technical details and forensic tooling.
This new report provides further technical details on the KindaRails2Shell vulnerability (CVE-2026-66066), highlighting that the flaw stems from the libvips image processing library's ability to open non-image file formats. It also clarifies that applications using the alternative ImageMagick processor are not affected, and outlines specific Rails versions impacted, including 7.0 releases before 7.2.3.2, 8.0 before 8.0.5.1, and 8.1 before 8.1.3.1.
The newly released article provides crucial details regarding the exploitation of CVE-2026-66066 (KindaRails2Shell), including the public release of a proof-of-concept exploit. It elaborates on how attackers could leverage a compromised secret_key_base to forge signed data and achieve remote code execution, a significant escalation beyond the initial report of unauthenticated file reads. Furthermore, it specifies the affected Rails versions and highlights the potential for severe impact on AWS-hosted environments due to exposed cloud credentials.
Rapid7's analysis delves into the technical specifics of CVE-2026-66066, detailing how attackers can exploit the arbitrary file read vulnerability by crafting specific MAT/HDF5 files. Their research confirms that a vulnerable application can disclose sensitive files, including Rails signing material, which could lead to full code execution when combined with a genuine variation key and specific application configurations like config.active_support.message_serializer = :json.