A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE).
Rails is a popular open-source web application framework written in Ruby for building websites and web apps. It uses the built-in Rails component Active Storage for handling file uploads and attachments.
Rails maintainers published an advisory about the CVE-2026-66066 flaw, which received a critical severity rating.
How the Vulnerability Works
Active Storage may also generate image thumbnails from uploaded media using image processing libraries such as libvips or ImageMagick.
According to the security bulletin, CVE-2026-66066 is exploitable when libvips is used, allowing an attacker to upload a specially crafted image to a vulnerable application and read arbitrary files on the server.
Another prerequisite for the attack is that the server needs to allow image uploads from untrusted users.
If these requirements are met, an attacker may access app files, including the process environment, which typically contains secret_key_base and credentials for databases, cloud storage, and other services.
Affected Versions
CVE-2026-66066 impacts Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1.
Rails 6.x is only affected if Active Storage has been configured outside its defaults.
Mitigations and Workarounds
The Rails team recommends upgrading to libvips 8.13 or later and rotating the secret_key_base (the Rails master key), database credentials, Active Storage service credentials, and any other secrets accessible to the application process.
For systems running libvips 8.13 or later, administrators can temporarily disable the vulnerable functionality by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) when using ruby-vips 2.2.1 or newer.
There is no workaround available for apps that use libvips before 8.13.
ImageMagick users are not affected by this vector. However, libvips is the default processor in the official Rails Docker images, as well as Debian and Ubuntu setups.
Exploit Details and Disclosure Timeline
The Rails team initially withheld technical details to reduce the risk of exploitation before users had time to apply updates, with full disclosure originally scheduled for August 28 on the Rails forums.
However, because public proof-of-concept (PoC) exploits became available very quickly, the maintainers decided to publish the full details as well as forensic investigation tooling.
The vulnerability was discovered and responsibly reported to the Rails team by researchers from Ethiack and GMO Flatt Security Inc.
RCE Potential: “KindaRails2Shell”
Security firm Akamai has published a warning about CVE-2026-66066, naming the attack chain “KindaRails2Shell” and warning about its RCE potential.
“With the secret_key_base compromised, the attacker holds the master cryptographic key to the application,” explains Akamai. “They can forge session cookies, sign global IDs, and manipulate serialized data, which directly translates into full RCE on the underlying server.”
Akamai coordinated with Ethiack before public disclosure to prepare protections for customers and has since released web application firewall (WAF) rules. Ethiack noted that a WAF may buy administrators some time, but attackers using AI tooling should be able to reconstruct the attack chain from patch diffs, making prompt upgrading and credential rotation the most reliable remediation.
