CVE-2026-66066: Rails Active Storage Arbitrary File Read — Upgrading Rails Alone Does Not Fix It

CVE-2026-66066 (KindaRails2Shell) hits Rails 7.0–8.1 across three branches, CVSSv4 9.5. Unauthenticated arbitrary file read via a malicious image upload. A Rails upgrade is not enough; you also need libvips 8.13+.

Overview

CVE-2026-66066, named KindaRails2Shell, was disclosed 1 August 2026 in Ruby on Rails Active Storage. CVSSv4 9.5 (Critical). An unauthenticated attacker reads any file the Rails worker can access by uploading a crafted image. The advisory landed 29 July; full technical details dropped 31 July, four weeks early. Rails apps using libvips as the image backend are a remote unauthenticated attack surface.

The bug is tightly coupled to default Active Storage config. libvips is a common backend for user-uploaded images — public signup, avatars, product photos, attachments. The patch chain requires libvips 8.13, which many production deployments lack. Upgrade Rails without it and the app may refuse to boot; the hole stays open.

Technical Details

Affected Versions and Patches

• Rails 7.0.x ~ 7.2.3.1: upgrade to 7.2.3.2
• Rails 8.0.0 ~ 8.0.5: upgrade to 8.0.5.1
• Rails 8.1.0 ~ 8.1.3: upgrade to 8.1.3.1
• Rails 6.0 / 6.1: affected when using the Vips backend; EOL, no official patch
• libvips: must upgrade to 8.13 or later in lockstep; patched Rails will refuse to start otherwise

Mechanism

Active Storage passes uploaded attachments to image analyzers and transformers. With a libvips backend, libvips starts processing without blocking unsafe operations. A crafted malicious image triggers an internal libvips op chain that reads any local file the Rails worker process can read, including /etc/shadow, `application.yml`, database credentials, and SSH private keys.

Researchers named it KindaRails2Shell because, under specific conditions, it can escalate to remote shell-level control. Characteristics:

• No prior auth: upload endpoints are typically open to unauthenticated users
• Network reachable: exposed on public web ports by default
• No user interaction: upload triggers it
• Config-dependent: exploitable only on deployments using a libvips backend

PoC and Disclosure Timeline

Disclosed by research group RECATOOLS. Full technical details were planned after patches had time to land. Escalating attack activity forced an early dump on 31 July (two days after the patch) of a complete PoC and analysis. Assume the PoC is already circulating in public channels.

Impact

CVSSv4 base 9.5 (Critical), vector `AV:N/AC:L/PR:N/UI:N`. Rails 6.x through 8.x — the three main branches, covering 12 years of releases since 2014. High risk for ecommerce SaaS, content platforms, social networks, and internal enterprise portals. File read yields database credentials, cloud API keys, KMS encryption keys, and SSH private keys, enabling lateral movement, data theft, and persistence.

Remediation

Immediate Actions

• Upgrade Rails: move to the fixed release on your branch (7.2.3.2 / 8.0.5.1 / 8.1.3.1)
• Upgrade libvips in lockstep: system libvips to 8.13+ (Ubuntu 22.04: jammy-backports; Debian 12: upgrade the distro package)
• Verify boot: patched Rails fails to start if libvips is too old — roll back or keep upgrading immediately
• Rotate credentials: assume attackers already read `credentials.yml.enc`, `database.yml`, `secrets.yml`, and every private key the Rails process can read. Rotate database passwords, AWS/GCP/Azure API keys, SSH keys, JWT signing keys now

Mitigation and Detection

• Temporarily switch Active Storage to the `:mini_magick` backend to avoid the libvips trigger path
• On WAF/CDN, temporarily block anomalous POST requests to Active Storage upload endpoints
• Watch Rails app logs for anomalous vips operations and libvips internal errors
• Inspect attachments-table metadata from the last 30 days; filter suspicious SVG, JXL, HEIC and other uncommon formats

Long-term Hardening

• Run image-processing jobs on a dedicated low-privilege worker to shrink credential blast radius
• Move secrets off the filesystem; host them in Vault / SSM / KMS and read them in memory
• Subscribe to the Rails security announcement list for patch notifications

References

• RECATOOLS: CVE-2026-66066 KindaRails2Shell technical analysis
• Ruby on Rails security advisory
• NVD: CVE-2026-66066 details