CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing — Threadlinqs Intelligence
As of 2026-08-03, CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 55 indicators of compromise.
Threat ID: TL-2026-1755 · Severity: CRITICAL · CVSS: 9.5 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-08-03 · 4 updates · revalidated 4× · latest source
A critical vulnerability (CVE-2026-66066, CVSS 9.5) in Ruby on Rails Active Storage lets an unauthenticated attacker who can upload an image trigger libvips loaders/savers marked
CVE-2026-66066 sits at the trust boundary between Rails Active Storage and libvips, the image-processing library Active Storage uses by default since Rails 7.0. libvips implements dozens of format "loaders" and "savers", several backed by third-party libraries (ImageMagick delegates, FITS, JPEG XL, JPEG 2000, Netpbm, and format handlers for BMP, ICO, PSD, TIFF, GIF, and VIPS-native containers) that upstream explicitly tags as "unfuzzed" or "untrusted" because they have not been hardened against hostile input. libvips 8.13 introduced a runtime control, VIPS_BLOCK_UNTRUSTED (or the equivalent Vips.block_untrusted(true) call available in ruby-vips >= 2.2.1), that prevents these operations from ever running against attacker-supplied bytes. Active Storage's variant analyzer and transformer, however, did not enable this control by default, so both code paths passed untrusted uploaded attachments straight into libvips without restricting which loaders/savers could execute.
Exploitation requires only that an application (a) has Active Storage enabled with file uploads, (b) uses libvips (the Rails 7.0+ default, as opposed to MiniMagick, which is not affected via this path), and (c) exposes any endpoint that renders or otherwise processes an image variant from attacker-supplied content — dedicated resize/thumbnail functionality is not required. By crafting an upload that libvips interprets through one of the unsafe loaders, an unauthenticated attacker can coerce the server into reading and returning the contents of arbitrary files on disk, including the Rails process environment. In a default Rails deployment that routinely places `secret_key_base`, the Rails master key, `config/credentials.yml.enc`, `config/database.yml`, and cloud/object-storage credentials in environment variables or config files, a single file-read primitive is sufficient to harvest the material needed to forge signed/encrypted cookies and session data — a well-established Rails post-exploitation technique that converts secret disclosure into remote code execution via insecure deserialization of forged payloads. GMO Flatt Security's advisory (nicknamed the vulnerability "KindaRails2Shell") states plainly that "arbitrary file read enables multiple techniques for arbitrary code execution" in Rails applications, and separately warns that "a PoC could be created within hours using AI" now that the vulnerability class is public, even though the maintainers withheld the precise trigger and payload construction until 2026-08-28.
Affected versions span activestorage < 7.2.3.2, >= 8.0 < 8.0.5.1, and >= 8.1 < 8.1.3.1; Rails 6.0.0–6.1.7.10 (both end-of-life branches) are vulnerable only where an application explicitly configures Vips as the image processor. The vendor fix calls `Vips.block_untrusted(true)` automatically when Active Storage boots, and additionally now refuses to boot (raising a RuntimeError) if the installed libvips/ruby-vips versions are too old to support blocking untrusted operations at all — an explicit "fail closed rather than run unsecurable" design decision. This is not Active Storage's first unsafe-transformation incident: CVE-2025-24293 (disclosed 2025-08-13, GHSA-r4mg-4433-c7g3) previously showed that Active Storage's transformation-method allowlist could be abused for ImageMagick command injection, prompting a strengthened security posture that CVE-2026-66066 shows was still incomplete for the libvips code path. No public proof-of-concept exploit and no in-the-wild exploitation had been confirmed as of the 2026-07-29 disclosure date, but given Rails' broad footprint as a production web framework and the trivial (upload-only) exploitation prerequisites, unpatched internet-facing Active Storage deployments face a high near-term risk of automated scanning and exploit development once the embargo lifts on 2026-08-28.
Weaknesses (CWE)
CWE-829, CWE-668, CWE-1188, CWE-77
Target sectors: technology, software-development, ecommerce, financial-services, health, government administration, saas, news - media
Target regions: Global
Update History
- 2026-08-03: What changed No escalation of severity, CVSS score, or status — both remain CRITICAL/9.5/ACTIVE. The report's own threat.exploitability field asserts ACTIVE, but its body text states plainly that 'no confirmed in-the-wild exploitation has b
- 2026-08-01 — Critical Rails Active Storage Flaw (CVE-2026-66066, "KindaRails2Shell") Enables Unauthenticated Arbitrary File Read and Chained RCE via libvips: What changed No field escalation: severity (CRITICAL), exploitability (POC_PUBLIC), status (ACTIVE), and CVSS score (9.5) are all unchanged from the existing record. The newer report scores CVSS v4.0 rather than v3.1 but at the same 9.5 mag
- 2026-08-01 — Critical Ruby on Rails Active Storage Flaw (CVE-2026-66066, CVSS 9.5) Enables Unauthenticated Arbitrary File Read, Potential RCE: What changed Exploitability THEORETICAL → POC_PUBLIC: a third-party PoC and Metasploit module (PR 21733) publicly demonstrate the full file-read-to-RCE chain (2026-07-31), ahead of the originally scheduled 2026-08-28 technical disclosure. S
- 2026-07-30 — Critical Rails Active Storage Vulnerability (CVE-2026-66066) Enables Arbitrary File Read and Remote Code Execution via libvips: What changed No severity/exploitability/status escalation — both reports agree CRITICAL, CVSS 9.5, THEORETICAL exploitability, ACTIVE status. The newer report adds a root-cause CWE classification (CWE-1188, Insecure Default Initialization o
Detections & IOCs
As of 2026-08-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 55 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-66066, T1595, T1588, T1190, T1059, T1068, T1211, T1027, T1552, T1082, T1005
