Vulnerabilities · 92 days ago
A crafted image upload can turn Active Storage into a file reader. The break is not an image crash; it is secret exposure from whatever the Rails process is allowed to see, which patching alone does not undo if those secrets were already taken.
Rails fixed CVE-2026-66066 in Active Storage, which affects apps using libvips for image processing and accepting untrusted uploads. The issue can expose environment data, secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens; Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 are the fixed releases, and 7.0 and 7.1 users must move to 7.2.3.2 or later.
The practical risk is broader than the upload path itself. If the application can read a secret, that secret can open databases, cloud storage, or connected systems, and the same trust-boundary flaw can exist anywhere untrusted uploads are handed to shared image libraries.
5 sources covering this story
Ra Kindarails2shell Technical Analysis CVE-2026-66066
Rapid7 analyzes KindaRails2Shell (CVE-2026-66066), a Ruby on Rails Active Storage vulnerability that can allow attackers to abuse libvips and crafted MAT/HDF5 uploads to read arbitrary files from the server.
KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066) - Help Net Security
A critical security vulnerability (CVE-2026-66066) in Ruby on Rails may allow attackers to read sensitive files off a server.
Ruby on Rails Patches Critical Vulnerability
The flaw can be exploited by unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE).
Rilevata vulnerabilità in Ruby on Rails
Rilasciato aggiornamento per risolvere una vulnerabilità di sicurezza con gravità “critica” in Ruby on Rails, noto framework open source per lo sviluppo di applicazioni web, scritto nel linguaggio di programmazione Ruby.
On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library.
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
CVE-2026-66066 could expose Rails server files through image uploads, leaking secrets that may enable RCE or lateral movement.
Part of the PlainSec briefing for 2026-08-02