VulnCheck says attackers are exploiting CVE-2026-66066, a critical Ruby on Rails flaw in apps that use Active Storage with libvips for image uploads. The bug, dubbed KindaRails2Shell, lets a crafted upload turn into arbitrary file read, secret disclosure, and, in some cases, remote code execution.
Rails and VulnCheck both traced the break to a parser mismatch: Rails may trust the upload’s declared type, while libvips follows the file’s magic bytes and hands it through other libraries until the app reads an attacker-chosen server file as if it were image data. That can expose credentials, which then lets an intruder forge sessions and move deeper.
VulnCheck also says a patched 8.1.3.1 server can still hit a Marshal deserialization gadget if the attacker has a valid signature, so the exposure does not end neatly at the patch boundary. For Rails estates that accept untrusted uploads, the remaining risk is not just file disclosure but any downstream secret or session trust that those files can unlock.