Threat reportVulnerabilityTL-2026-1755

CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing

criticalACTIVE

CVE-2026-66066 "KindaRails2Shell" (TL-2026-1755), also tracked as KindaRails2Shell, is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-07-29 and last reviewed 2026-08-31. It has no confirmed attribution, affects Ruby on Rails Active Storage (activestorage RubyGem), references 2 CVEs (CVE-2026-66066, CVE-2025-24293), maps to 35 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 61 indicators of compromise.

CVSS
9.5/10Critical
CVEs
2Referenced vulnerabilities
Techniques
35MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
61Indicators of compromise

Key facts for TL-2026-1755

Threat ID
TL-2026-1755
Also known as
KindaRails2Shell
Severity
CRITICAL
CVSS
9.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development, ecommerce, financial-services, health, government administration, saas, news - media
Target regions
Global
Detection rules
9
Indicators of compromise
61
Updates
2026-08-31 · 5 updates · revalidated 5× · latest source

Malware and tooling in CVE-2026-66066 "KindaRails2Shell"

Malware and tooling: libvips

How CVE-2026-66066 "KindaRails2Shell" works

A critical vulnerability (CVE-2026-66066, CVSS 9.5) in Ruby on Rails Active Storage lets an unauthenticated attacker who can upload an image trigger libvips loaders/savers marked "unfuzzed"/"untrusted" during variant processing, yielding arbitrary server-side file read. Leaked secrets (secret_key_base, Rails master key, database credentials, cloud storage credentials, API tokens) create a documented path to remote code execution. Independently discovered by GMO Flatt Security's RyotaK and an Ethiack team (0xacb, s3np41k1r1t0, and Castilho); the Rails security advisory was published 2026-07-29 by Rails security team member Rafael França, with fixed releases 7.2.3.2, 8.0.5.1, and 8.1.3.1 confirmed by 2026-07-30 and full technical exploitation detail embargoed until 2026-08-28.

CVE-2026-66066 sits at the trust boundary between Rails Active Storage and libvips, the image-processing library Active Storage uses by default since Rails 7.0. libvips implements dozens of format "loaders" and "savers", several backed by third-party libraries (ImageMagick delegates, FITS, JPEG XL, JPEG 2000, Netpbm, and format handlers for BMP, ICO, PSD, TIFF, GIF, and VIPS-native containers) that upstream explicitly tags as "unfuzzed" or "untrusted" because they have not been hardened against hostile input. libvips 8.13 introduced a runtime control, VIPS_BLOCK_UNTRUSTED (or the equivalent Vips.block_untrusted(true) call available in ruby-vips >= 2.2.1), that prevents these operations from ever running against attacker-supplied bytes. Active Storage's variant analyzer and transformer, however, did not enable this control by default, so both code paths passed untrusted uploaded attachments straight into libvips without restricting which loaders/savers could execute.

Exploitation requires only that an application (a) has Active Storage enabled with file uploads, (b) uses libvips (the Rails 7.0+ default, as opposed to MiniMagick, which is not affected via this path), and (c) exposes any endpoint that renders or otherwise processes an image variant from attacker-supplied content — dedicated resize/thumbnail functionality is not required. By crafting an upload that libvips interprets through one of the unsafe loaders, an unauthenticated attacker can coerce the server into reading and returning the contents of arbitrary files on disk, including the Rails process environment. In a default Rails deployment that routinely places `secret_key_base`, the Rails master key, `config/credentials.yml.enc`, `config/database.yml`, and cloud/object-storage credentials in environment variables or config files, a single file-read primitive is sufficient to harvest the material needed to forge signed/encrypted cookies and session data — a well-established Rails post-exploitation technique that converts secret disclosure into remote code execution via insecure deserialization of forged payloads. GMO Flatt Security's advisory (nicknamed the vulnerability "KindaRails2Shell") states plainly that "arbitrary file read enables multiple techniques for arbitrary code execution" in Rails applications, and separately warns that "a PoC could be created within hours using AI" now that the vulnerability class is public, even though the maintainers withheld the precise trigger and payload construction until 2026-08-28.

Affected versions span activestorage < 7.2.3.2, >= 8.0 < 8.0.5.1, and >= 8.1 < 8.1.3.1; Rails 6.0.0–6.1.7.10 (both end-of-life branches) are vulnerable only where an application explicitly configures Vips as the image processor. The vendor fix calls `Vips.block_untrusted(true)` automatically when Active Storage boots, and additionally now refuses to boot (raising a RuntimeError) if the installed libvips/ruby-vips versions are too old to support blocking untrusted operations at all — an explicit "fail closed rather than run unsecurable" design decision. This is not Active Storage's first unsafe-transformation incident: CVE-2025-24293 (disclosed 2025-08-13, GHSA-r4mg-4433-c7g3) previously showed that Active Storage's transformation-method allowlist could be abused for ImageMagick command injection, prompting a strengthened security posture that CVE-2026-66066 shows was still incomplete for the libvips code path. No public proof-of-concept exploit and no in-the-wild exploitation had been confirmed as of the 2026-07-29 disclosure date, but given Rails' broad footprint as a production web framework and the trivial (upload-only) exploitation prerequisites, unpatched internet-facing Active Storage deployments face a high near-term risk of automated scanning and exploit development once the embargo lifts on 2026-08-28.

MITRE ATT&CK techniques used in TL-2026-1755

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Stealth

T1036.008 Masquerading: Masquerade File Type

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

stealth

T1078 Valid Accounts

Persistence

T1078.004 Valid Accounts: Cloud Accounts; T1505 Server Software Component

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1526 Cloud Service Discovery

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services; T1550.004 Use Alternate Authentication Material: Web Session Cookie

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1606 Forge Web Credentials; T1606.001 Forge Web Credentials: Web Cookies

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1592 Gather Victim Host Information; T1594 Search Victim-Owned Websites; T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in CVE-2026-66066 "KindaRails2Shell"

  • Ruby on Rails — Active Storage (activestorage RubyGem)
    Vulnerable versions: 6.0.0-6.1.7.10 (only when libvips is explicitly configured as the image processor); 7.0.0-7.2.3.1 (libvips is the Rails 7.0+ default processor); 8.0.0-8.0.5; 8.1.0-8.1.3
    Fixed in: 7.2.3.2; 8.0.5.1; 8.1.3.1
  • libvips — libvips image processing library
    Vulnerable versions: < 8.13 (cannot enforce VIPS_BLOCK_UNTRUSTED at all)
    Fixed in: >= 8.13, used together with VIPS_BLOCK_UNTRUSTED / Vips.block_untrusted(true)
  • ruby-vips — ruby-vips gem (Ruby bindings for libvips)
    Vulnerable versions: < 2.2.1
    Fixed in: >= 2.2.1

Remediation for CVE-2026-66066 "KindaRails2Shell"

Patches

  • Rails/activestorage 7.2.3.2
  • Rails/activestorage 8.0.5.1
  • Rails/activestorage 8.1.3.1

Immediate actions

  • Upgrade Rails/activestorage to 7.2.3.2, 8.0.5.1, or 8.1.3.1
  • Ensure libvips >= 8.13 and ruby-vips >= 2.2.1 are installed so untrusted operations can be blocked at all
  • Set the VIPS_BLOCK_UNTRUSTED environment variable to true, or call Vips.block_untrusted(true) in a Rails initializer, as defense in depth even after patching
  • Rotate secret_key_base, the Rails master key, database credentials, cloud/object-storage credentials, and API tokens on any host that processed untrusted image uploads prior to patching

Workarounds

  • Remove the ruby-vips dependency entirely if Active Storage image variant processing is not required
  • Restrict or gate untrusted-upload endpoints at the edge/WAF until patched (researchers note WAF mitigation has "extremely limited effectiveness" given the configuration-dependent attack path)

Longer-term hardening

  • Pin minimum libvips/ruby-vips versions in CI/CD so deployments fail closed rather than run in an unsecurable configuration
  • Reduce libvips attack surface by building with only the image loaders/savers actually required by the application (strike unused formats such as FITS, CSV, JPEG XL from the build)
  • Prefer maintained, safer delegate libraries where libvips depends on third parties (e.g., libspng instead of libpng, pdfium instead of poppler)
  • Add native image-processing dependencies (libvips, ImageMagick, ruby-vips, mini_magick, image_processing) to software composition analysis / dependency vulnerability monitoring

CVEs associated with CVE-2026-66066 "KindaRails2Shell"

CVE-2026-66066, CVE-2025-24293

Weaknesses (CWE) in CVE-2026-66066 "KindaRails2Shell"

CWE-829, CWE-668, CWE-1188, CWE-77

Timeline of CVE-2026-66066 "KindaRails2Shell"

Showing the 20 most recent tracked events.

  • Rails releases versions 7.2.3.1, 8.0.4.1, and 8.1.2.1 — the immediately-preceding patch baseline that CVE-2026-66066 is later found to still affect.
  • Ethiack researchers complete an initial working proof-of-concept for the Active Storage libvips arbitrary file read chain.
  • Ethiack reports the vulnerability to the Rails security team.
  • Rails security team acknowledges the report and begins coordinated remediation.
  • Akamai deploys Rapid Rule 3000989 v1 ("Rails2Shell Exploit Attempt Detected") for WAF-level defense-in-depth via App and API Protector.
  • Ethiack researcher André Baptista (0xacb) publicly posts on X confirming the KindaRails2Shell disclosure and urging immediate patching; the official @rails account also posts about the advisory the same day, amplifying visibility beyond Rails-specific channels.
  • Ethiack's KindaRails2Shell write-up clarifies the flaw is viable in "common setups" rather than a fully default `rails new` scaffold, since the official Rails Docker images and Debian/Ubuntu packaging ship libvips as the default Active Storage image processor — widening the real-world exposed population beyond apps that explicitly opted into Vips.
  • TL-Intel Harness RSS hunt phase surfaces the threat from The Hacker News coverage and opens threat record TL-2026-1755.
  • CVE-2026-66066 is publicly disclosed at 15:37 via a Rails security advisory on discuss.rubyonrails.org, posted by Rails security team member Rafael França, and covered by The Hacker News; the advisory ships Rails 7.2.3.2 disabling libvips's unfuzzed/untrusted loaders and savers by default for Active Storage.
  • Rapid7 and the Rails Security Team report no confirmed in-the-wild exploitation; Rapid7 publishes its own KindaRails2Shell threat analysis.
  • GMO Flatt Security publishes a technical analysis nicknaming the flaw "KindaRails2Shell," crediting independent discovery by RyotaK and an Ethiack team (0xacb, s3np41k1r1t0, and Castilho); Rails 8.0.5.1 and 8.1.3.1 patched releases are confirmed alongside 7.2.3.2.
  • A third-party GitHub repository publishes working exploit code demonstrating the full file-read-to-RCE chain, prompting Rails to release its forensic toolkit and additional technical detail early; Rapid7 ships InsightVM/Nexpose/Exposure Command detection content and a Metasploit module (PR #21733) verifying the RCE escalation path is opened.
  • Community detection repository 0xBlackash/CVE-2026-66066 published with Sigma rules, YARA rules, and IOC listings for forensic detection.
  • BleepingComputer reports public PoC exploits are available, including a third-party GitHub repository claiming to reproduce the full file-read-to-RCE chain in a loopback-only Docker environment.
  • Media coverage broadens (SecurityWeek, TheHackerNews, SOCPrime, HeroDevs) urging immediate patching ahead of the still-scheduled full technical disclosure, now largely preempted by the July 31 PoC leak.
  • VulnCheck reports roughly 7,000-7,100 internet-exposed, vulnerable Rails instances identified via scanning.
  • CISA KEV catalog still does not include CVE-2026-66066; EPSS score 1.701% (75th percentile); Rails security team and Rapid7 report no confirmed in-the-wild exploitation; global patch adoption underway.
  • VulnCheck's initial-access tracking notes no confirmed exploitation observed yet, but expects it given the exposed footprint and public technical detail.
  • Rails security team's scheduled date to release full technical exploitation details that were withheld from the initial disclosure to slow weaponization, per the discuss.rubyonrails.org advisory.
  • SecurityWeek reports active exploitation of CVE-2026-66066 confirmed roughly one month after patches were released, consistent with public PoC code and the weaponized Rapid7 Metasploit module.

Update history for TL-2026-1755

Sources cited for CVE-2026-66066 "KindaRails2Shell"

Detection coverage for TL-2026-1755

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1755 across Splunk SPL, Microsoft KQL and Sigma, covering 61 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
61 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats