KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

1. Executive summary

CVE-2026-66066 is a critical (CVSS 9.5) insecure default initialization vulnerability (CWE-1188) in Ruby on Rails Active Storage, exploitable when the libvips image processing library handles untrusted image uploads. An unauthenticated attacker can leverage unsafe libvips operations to read arbitrary files accessible to the Rails process, potentially exposing secret_key_base, database credentials, and storage tokens to achieve remote code execution (RCE). As of July 30, 2026, the vulnerability is not in CISA KEV and no confirmed exploitation in the wild has been observed, though public proof-of-concept code of unverified quality exists. EMEA financial services running Rails 7.x or 8.x with default configurations face immediate exposure of application secrets if they accept user image uploads.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

1. Preconditions: The target application runs Ruby on Rails with Active Storage configured to use the Vips variant processor (default for Rails 7.0+). The application accepts image uploads from untrusted users. Generating image variants is not a separate requirement for exposure.
2. Initial access: The attacker uploads a crafted image file to an Active Storage endpoint.
3. Vulnerability trigger: Active Storage passes the user-supplied file to libvips for processing. libvips uses operations backed by third-party libraries to load and save image formats; some of these operations are marked "unfuzzed" or "untrusted" because they are unsafe for untrusted content. Active Storage did not disable these untrusted operations before processing user-supplied files.
4. Arbitrary file read: The crafted upload triggers an unsafe libvips operation, which discloses files readable by the Rails application process. This includes the process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and third-party service tokens.
5. Potential RCE: Exfiltration of secret_key_base and the Rails master key may enable an attacker to forge signed cookies, signed global IDs, and Active Storage URLs, or decrypt credentials, potentially leading to remote code execution or access to connected systems.

Affected versions

• Rails 7.0.0 through 7.2.3.1 (Vips is default from 7.0+)
• Rails 8.0.0 through 8.0.5
• Rails 8.1.0 through 8.1.3
• Rails 6.0.0 through 6.1.7.10 (only if manually configured to use Vips; Vips is not default on 6.x — single-sourced to Ethiack; verify before enforcement)

Not affected: Applications using the Magick (ImageMagick) processor instead of Vips are not affected through the reported vector.

Confidence caveat: Ethiack and GMO Flatt Security, who independently reported the vulnerability, have withheld full attack chain details and proof-of-concept code. Public code claiming to exploit CVE-2026-66066 exists, but it is unclear how closely it corresponds to the full privately reported chain. Additional technical details are expected no later than August 28, 2026.

4. Mitigation & containment

P1 — Within 24 hours

• Identify all Rails applications using Active Storage with Vips. Check config/application.rb or environment configs for config.active_storage.variant_processor = :vips or Rails 7.0+ default configuration.
• If libvips 8.13 or later is installed, immediately set the environment variable VIPS_BLOCK_UNTRUSTED on all application hosts as a temporary workaround. Alternatively, with ruby-vips 2.2.1 or later, call Vips.block_untrusted(true) from an initializer.
• If libvips is older than 8.13, remove the libvips dependency immediately or switch to the Magick processor as a stopgap.

P2 — Within 72 hours

• Upgrade Rails and Active Storage to a fixed release:
• Rails 7.x → 7.2.3.2 (Active Storage 7.2.3.2)
• Rails 8.0.x → 8.0.5.1 (Active Storage 8.0.5.1)
• Rails 8.1.x → 8.1.3.1 (Active Storage 8.1.3.1)
• Ensure libvips is version 8.13 or later. Updating Rails or Active Storage alone is not sufficient when an older libvips version is installed; patched versions will refuse to start if ruby-vips or libvips is too old.
• Ensure ruby-vips is version 2.2.1 or later.
• For Rails 6.x applications configured with Vips: no fixed 6.x release exists. Migrate to a supported fixed branch (7.2.3.2, 8.0.5.1, or 8.1.3.1) or apply the workaround above.

P3 — Within 7 days

• Rotate all secrets accessible to the application process: secret_key_base, Rails master key, decrypted credentials, storage service credentials, database credentials, and third-party service tokens or keys. Replacing secret_key_base expires active sessions and invalidates encrypted/signed cookies, signed global IDs, and Active Storage URLs — coordinate with application teams for session disruption.
• Audit application logs for anomalous image upload activity and unexpected file access patterns.
• Rapid7 InsightVM, Nexpose, and Exposure Command customers can assess exposure using vulnerability checks expected in the July 31 content release.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7 — "KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails" — https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails — 2026-07-30
• The Hacker News — "Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads" — https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html — 2026-07-30
• ANSSI France CERT — "Vulnérabilité dans Ruby on Rails activestorage (30 juillet 2026)" — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0948/ — 2026-07-30

8. Adverse Trace position

CVE-2026-66066 is a critical-severity vulnerability (CVSS 9.5, CWE-1188) with a credible path to remote code execution via secret exfiltration, affecting default Rails 7.0+ configurations that accept user image uploads. The attack is unauthenticated and requires no variant generation beyond the initial upload. No confirmed exploitation in the wild exists as of July 30, 2026, and the vulnerability is not in CISA KEV, but public exploit code of unverified fidelity is circulating and full disclosure is expected by August 28, 2026. EMEA financial services running affected Rails versions with Vips should treat this as an urgent out-of-cycle remediation: apply the VIPS_BLOCK_UNTRUSTED workaround within 24 hours, patch to fixed releases within 72 hours, and rotate all application secrets within 7 days. Adverse Trace will monitor for confirmed exploitation reports and updated PoC fidelity, and will issue a follow-up advisory if the August 28 disclosure reveals additional attack-chain detail or active exploitation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.