Ruby on Rails maintainers have released patches for a critical vulnerability in the framework’s Active Storage component that could let unauthenticated attackers read arbitrary files from a Rails application, potentially escalating to full remote code execution.

Tracked as CVE-2026-66066 and rated with a CVSS score of 9.5, the flaw affects applications that use the libvips library for Active Storage image processing and that allow image uploads from untrusted users. Because libvips marks certain file read and write operations as “unfuzzed” (unsafe for untrusted content) and Active Storage did not disable those operations, an attacker can upload a specially crafted image to trigger arbitrary file disclosure on the server.

What’s at risk

Exposed files can include the application’s process environment, which typically contains the secret_key_base (the Rails master key), along with database credentials, cloud storage keys, and other service secrets. Security firm Akamai has dubbed the attack chain “KindaRails2Shell,” warning that compromise of secret_key_base can hand an attacker the means to escalate to remote code execution.

ImageMagick-based deployments are not affected by this vector, but libvips is the default image processor in official Rails Docker images as well as standard Debian and Ubuntu setups, making the exposure widespread.

Affected versions and fixes

  • Active Storage before 7.2.3.2
  • 8.0.x before 8.0.5.1
  • 8.1.x before 8.1.3.1
  • Rails 6.x, only if Active Storage was configured outside its defaults

Maintainers urge upgrading to the patched Active Storage releases and to libvips 8.13 or later, which supports disabling unfuzzed operations via the VIPS_BLOCK_UNTRUSTED environment variable or the Vips.block_untrusted(true) call in ruby-vips 2.2.1+. No workaround exists for applications still running libvips versions prior to 8.13.

Secrets rotation is mandatory

Because patching does not undo any secrets that may have already been exfiltrated, the Rails team advises treating every secret accessible to the application process as potentially compromised and rotating them immediately, including secret_key_base, database credentials, and Active Storage service credentials.

The vulnerability was reported responsibly by researchers from Ethiack and GMO Flatt Security Inc. Full technical details, originally scheduled for disclosure on August 28, were released early after public proof-of-concept exploits surfaced. As of July 30, Rapid7 reported no evidence of in-the-wild exploitation, though organizations running affected configurations should patch without delay.