# CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing

> A critical vulnerability (CVE-2026-66066, CVSS 9.5) in Ruby on Rails Active Storage lets an unauthenticated attacker who can upload an image trigger libvips loaders/savers marked "unfuzzed"/"untrusted" during variant processing, yielding arbitrary server-side file read. Leaked secrets (secret_key_base, Rails master key, database credentials, cloud storage credentials, API tokens) create a documented path to remote code execution. Independently discovered by GMO Flatt Security's RyotaK and an Ethiack team (0xacb, s3np41k1r1t0, and Castilho); the Rails security advisory was published 2026-07-29 by Rails security team member Rafael França, with fixed releases 7.2.3.2, 8.0.5.1, and 8.1.3.1 confirmed by 2026-07-30 and full technical exploitation detail embargoed until 2026-08-28.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-08-31T12:18:50.940Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1755
- **ID:** TL-2026-1755
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 61 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-66066, CVE-2025-24293

## Description

CVE-2026-66066 sits at the trust boundary between Rails Active Storage and libvips, the image-processing library Active Storage uses by default since Rails 7.0. libvips implements dozens of format "loaders" and "savers", several backed by third-party libraries (ImageMagick delegates, FITS, JPEG XL, JPEG 2000, Netpbm, and format handlers for BMP, ICO, PSD, TIFF, GIF, and VIPS-native containers) that upstream explicitly tags as "unfuzzed" or "untrusted" because they have not been hardened against hostile input. libvips 8.13 introduced a runtime control, VIPS_BLOCK_UNTRUSTED (or the equivalent Vips.block_untrusted(true) call available in ruby-vips >= 2.2.1), that prevents these operations from ever running against attacker-supplied bytes. Active Storage's variant analyzer and transformer, however, did not enable this control by default, so both code paths passed untrusted uploaded attachments straight into libvips without restricting which loaders/savers could execute.

Exploitation requires only that an application (a) has Active Storage enabled with file uploads, (b) uses libvips (the Rails 7.0+ default, as opposed to MiniMagick, which is not affected via this path), and (c) exposes any endpoint that renders or otherwise processes an image variant from attacker-supplied content — dedicated resize/thumbnail functionality is not required. By crafting an upload that libvips interprets through one of the unsafe loaders, an unauthenticated attacker can coerce the server into reading and returning the contents of arbitrary files on disk, including the Rails process environment. In a default Rails deployment that routinely places `secret_key_base`, the Rails master key, `config/credentials.yml.enc`, `config/database.yml`, and cloud/object-storage credentials in environment variables or config files, a single file-read primitive is sufficient to harvest the material needed to forge signed/encrypted cookies and session data — a well-established Rails post-exploitation technique that converts secret disclosure into remote code execution via insecure deserialization of forged payloads. GMO Flatt Security's advisory (nicknamed the vulnerability "KindaRails2Shell") states plainly that "arbitrary file read enables multiple techniques for arbitrary code execution" in Rails applications, and separately warns that "a PoC could be created within hours using AI" now that the vulnerability class is public, even though the maintainers withheld the precise trigger and payload construction until 2026-08-28.

Affected versions span activestorage < 7.2.3.2, >= 8.0 < 8.0.5.1, and >= 8.1 < 8.1.3.1; Rails 6.0.0–6.1.7.10 (both end-of-life branches) are vulnerable only where an application explicitly configures Vips as the image processor. The vendor fix calls `Vips.block_untrusted(true)` automatically when Active Storage boots, and additionally now refuses to boot (raising a RuntimeError) if the installed libvips/ruby-vips versions are too old to support blocking untrusted operations at all — an explicit "fail closed rather than run unsecurable" design decision. This is not Active Storage's first unsafe-transformation incident: CVE-2025-24293 (disclosed 2025-08-13, GHSA-r4mg-4433-c7g3) previously showed that Active Storage's transformation-method allowlist could be abused for ImageMagick command injection, prompting a strengthened security posture that CVE-2026-66066 shows was still incomplete for the libvips code path. No public proof-of-concept exploit and no in-the-wild exploitation had been confirmed as of the 2026-07-29 disclosure date, but given Rails' broad footprint as a production web framework and the trivial (upload-only) exploitation prerequisites, unpatched internet-facing Active Storage deployments face a high near-term risk of automated scanning and exploit development once the embargo lifts on 2026-08-28.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1005 Data from Local System
- T1210 Exploitation of Remote Services
- T1505 Server Software Component
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories
- T1594 Search Victim-Owned Websites
- T1212 Exploitation for Credential Access
- T1606 Forge Web Credentials
- T1078 Valid Accounts
- T1555 Credentials from Password Stores
- T1567 Exfiltration Over Web Service
- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.002 Obtain Capabilities: Tool
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1036.008 Masquerading: Masquerade File Type
- T1606.001 Forge Web Credentials: Web Cookies
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1078.004 Valid Accounts: Cloud Accounts

## Sources

- [The Hacker News: Critical Rails Flaw Could Let Attackers Read Server Files](https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html)
- [CVE-2026-66066 Possible arbitrary file read and remote code execution in Active Storage variant processing](https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432)
- [深刻度「緊急」のRailsの脆弱性「KindaRails2Shell」（CVE-2026-66066）の概要と対応指針](https://blog.flatt.tech/entry/kindarails2shell_rails)
- [CVE-2025-24293 - Active Storage allowed transformation methods that were potentially unsafe (GHSA-r4mg-4433-c7g3)](https://github.com/advisories/GHSA-r4mg-4433-c7g3)
- [Rails security advisory: Active Storage allowed transformation methods potentially unsafe](https://github.com/rails/rails/security/advisories/GHSA-r4mg-4433-c7g3)
- [Security risks when running image processing tools (libvips maintainer discussion)](https://github.com/libvips/libvips/discussions/3705)
- [Block unfuzzed loaders with libvips 8.13+ (image_processing gem issue #105)](https://github.com/janko/image_processing/issues/105)
- [sharp: Inherited libvips Vulnerabilities in GIF, TIFF, and VIPS Loaders (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591)](https://securelayer7.net/lab/sharp-libvips-gif-tiff-vips-loader-vulnerabilities-cve-2026-33327)
- [Rails Versions 7.2.3.1, 8.0.4.1, and 8.1.2.1 have been released](https://rubyonrails.org/2026/3/23/Rails-Versions-7-2-3-1-8-0-4-1-and-8-1-2-1-have-been-released)
- [NVD - CVE-2026-66066 (record pending, status RESERVED at time of publication)](https://nvd.nist.gov/vuln/detail/CVE-2026-66066)
- [RyotaK CVE disclosure list](https://ryotak.net/cve/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1755