Full Report
A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). [...]
Analysis Summary
# Vulnerability: Critical Arbitrary File Read and RCE in Rails Active Storage
## CVE Details
- **CVE ID:** CVE-2026-66066
- **CVSS Score:** Critical (Specific numerical score not provided in text, but categorized as Critical)
- **CWE:** Not specified (Likely related to Improper Input Validation or Path Traversal leading to Information Disclosure)
## Affected Systems
- **Products:** Ruby on Rails (Active Storage framework)
- **Versions:**
- Versions prior to 7.2.3.2
- 8.0.x versions prior to 8.0.5.1
- 8.1.x versions prior to 8.1.3.1
- Rails 6.x (Only if Active Storage is configured outside of defaults)
- **Configurations:**
- The application must allow image uploads from untrusted users.
- The application must use **libvips** as the image processing library (default in Rails Docker images and Debian/Ubuntu setups).
## Vulnerability Description
The flaw exists within the Active Storage component of Rails when processing images via the libvips library. An unauthenticated attacker can upload a specially crafted image that, when processed for thumbnail generation, allows the attacker to read arbitrary files from the server.
While the initial flaw is an arbitrary file read, it can be escalated to **Remote Code Execution (RCE)**. By reading sensitive files such as the `secret_key_base` (Rails master key) or environment variables, an attacker can forge session cookies and manipulate serialized data to execute code on the underlying server.
## Exploitation
- **Status:** PoC available; full technical details and attack chain ("KindaRails2Shell") have been publicly disclosed.
- **Complexity:** Low/Medium (Attackers can use AI tooling to reconstruct the attack from patch diffs).
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Access to arbitrary files, database credentials, and cryptographic keys).
- **Integrity:** High (Potential for full system takeover and RCE).
- **Availability:** High (Total compromise of the application and server).
## Remediation
### Patches
Update Rails to the following versions or later:
- **7.2.3.2**
- **8.0.5.1**
- **8.1.3.1**
Additionally, it is recommended to upgrade **libvips** to version **8.13** or later.
### Workarounds
1. **For systems with libvips 8.13+:** Disable untrusted functionality by setting the `VIPS_BLOCK_UNTRUSTED` environment variable or calling `Vips.block_untrusted(true)` in ruby-vips 2.2.1+.
2. **Switch Processors:** Applications using **ImageMagick** are not affected by this specific vector.
3. **Secret Rotation:** If a compromise is suspected, rotate `secret_key_base`, database credentials, and cloud storage keys.
## Detection
- **Indicators of Compromise:** Unusual file access patterns; presence of crafted image files in upload directories.
- **Detection methods and tools:**
- Use the official Rails forensic investigation tool: `https[:]//github[.]com/rails/rails-forensics-CVE-2026-66066`
- Monitor web application firewall (WAF) logs for exploitation attempts (Protections released by Akamai and other vendors).
## References
- Rails Security Advisory: `https[:]//github[.]com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm`
- Rails Forum Attack Details: `https[:]//discuss[.]rubyonrails[.]org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441`
- CVE Record: `https[:]//www[.]cve[.]org/CVERecord?id=CVE-2026-66066`
- Ethiack Research: `https[:]//ethiack[.]com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066`