In brief: The critical Rails vulnerability CVE-2026-66066 (CVSS 9.5) allows attackers to exploit manipulated image uploads in Active Storage to read sensitive secrets and even achieve remote code execution, and should be remediated by immediately patching to versions 7.2.3.2, 8.0.5.1, or 8.1.3.1.
A vulnerability disclosed on July 30 in the Active Storage module of Ruby on Rails allows unauthenticated attackers to read sensitive files or achieve remote code execution via manipulated image uploads. With a CVSS score of 9.5, the flaw ranks among the most critical Rails vulnerabilities in recent memory.
The vulnerability, dubbed “KindaRails2Shell” and tracked as CVE-2026-66066, affects the Active Storage component built into Ruby on Rails, which applications use to process file uploads to cloud services or local storage. The root cause lies in the interaction between Active Storage and the image processing library libvips: libvips contains so-called “unfuzzed” operations that have not been hardened against malicious input and are therefore unsuitable for handling untrusted content. However, Active Storage does not sufficiently disable these unsafe operations. Applications are affected if they use libvips for image processing — the default configuration since Rails 7.0 — and accept uploads from unauthenticated or untrusted users. The flaw has been fixed in Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.
According to Ensar Seker, CISO at SOCRadar, an attacker needs neither a user account nor privileged access to exploit the flaw. Using specially crafted files disguised as images, the attacker can trick the insecure processing pipeline into disclosing files that the Rails process has access to — including environment variables, application secrets, database credentials, cloud access keys, and API tokens. Seker notes that particularly critical is the potential access to the secret_key_base, which Rails uses to sign and encrypt cookies, credentials, and session data. If this key is compromised, an attacker can forge session data, impersonate a trusted entity, and in the worst case gain access to databases and connected cloud services or move laterally to other systems.
For organizations, this means that seemingly harmless features such as profile pictures, avatars, or thumbnail generators can become an entry point into the underlying infrastructure. David Shipley of Beauceron Security succinctly describes the core of the vulnerability: an attacker can upload an image that isn’t actually an image at all, but code designed to steal secrets. What initially appears to be a limited information disclosure vulnerability can, through the theft of the secret_key_base, escalate into a far more extensive compromise of the entire application.
CISOs should promptly check all internal and third-party-operated applications to determine whether they use Rails with Active Storage and libvips-based image processing, and patch the affected versions immediately. This includes taking stock of all features that accept image uploads, including avatars, support attachments, and similar upload paths, as well as verifying whether unauthenticated users have access to such upload functions. Given the active community of over 1,000 Rails developers and the framework’s widespread use in enterprise applications, rapid evolution of exploit techniques is to be expected.
Source: www.csoonline.com · Published August 5, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.