KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

A critical security vulnerability (CVE-2026-66066) in Ruby on Rails (aka Rails), one of the most widely used frameworks for building websites and web apps, may allow attackers to read sensitive files off a server and, in some cases, take full control of it.

Nicknamed “KindaRails2Shell” by the researchers who found it, the flaw lets an attacker sneak a booby-trapped file past a website’s image-upload feature and use it to pry open the server’s secrets.

About CVE-2026-66066

Lots of websites let you upload images and then show you back a resized version. Rails handles this through a built-in tool called Active Storage, which leans on an image-processing library called libvips for resizing.

The problem is in libvips’ capability to open more than just ordinary image files. It will also load obscure scientific and specialty file formats such as MATLAB .mat files, NIfTI medical scans, SVG and PDF files, and more.

The tools libvips uses to open some of these formats are unsafe to run on files that come from strangers, and Rails wasn’t switching them off. So an attacker can craft a file that looks like a harmless image but when the server tries to make a thumbnail of it, the file covertly instructs the server to read whatever the attacker asks for.

“In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret_key_base and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems,” a member of Rails’ core team explained.

Who’s affected?

If you run a Rails-based website or app, you’re exposed if:

• Your app uses Active Storage with the default image processor (called “vips”), which has been the standard setup since Rails 7.
• Your app lets users upload images via features or direct uploads.
• You’re running one of the affected Active Storage 7.0 releases before 7.2.3.2, as well as 8.0 releases before 8.0.5.1 and 8.1 releases before 8.1.3.1.

“Rails 6.0.0 through 6.1.7.10 may be affected only if Active Storage has been set up outside its defaults, so a normal 6.x install isn’t exposed to this vulnerability,” Ethiack researchers noted.

“Please note that any user-facing feature that accepts an image upload and later serves back a processed version (avatars, thumbnails, profile pictures) may also be affected by this vulnerability. Multiple projects and 3rd party software that use Ruby on Rails may also be affected.”

Apps configured to use the alternative “ImageMagick” processor instead of “vips” are not affected.

Discovery and fix

CVE-2026-66066 was first discovered and reported by André Baptista, Bruno Mendes and Rafael Castilho of the Ethiack research team, and then independently reported by RyotaK of GMO Flatt Security’s research team.

Rails released the fix on July 29, 2026, in Rails versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.

Affected users have been urged to upgrade to one of those versions, update libvips to version 8.13 or later, and rotate their app’s master key, database credentials, storage service (S3, GCS, or Azure) keys, and third-party service tokens or keys, just in case.

“If libvips < 8.13 is being used, there are no workarounds available other than removing the dependency on libvips from the application," the Rails team added, and noted that if libvips >= 8.13 is present on the system, “applications can disable the unfuzzed operations without upgrading Rails by setting the VIPS_BLOCK_UNTRUSTED environment variable, which libvips reads while initializing.”

Security vendor Akamai says it coordinated with Ethiack ahead of public disclosure to prepare protections for its customers, and has now deployed web application firewall rules aimed at the KindaRails2Shell attack.

But both Akamai and the Ethiack researchers stressed that a WAF is not a substitute for patching.

“Although web application firewall (WAF) rules can identify and block known exploit patterns, the most effective defense is to promptly apply the patches provided by the vendor and rotate any potentially compromised credentials,” the former stated.

Detection and forensic tools

The Rails and Ethiack team initially held back vulnerability details and exploit code to give everyone time to patch.

However, other researchers reverse-engineered the attack and published proof-of-concept exploits soon after disclosure, pushing Ethiack researchers to publish a technical deep-dive.

The Rails team also released two agent skills that individuals and organizations can use to check whether their Rails application was open to attack and for how long, and whether anyone took advantage of the opening provided by the flaw and what sensitive information they accessed.

The repository also contains an explainer of the attack and a document explaining how to investigate a possible intrusion.

There are currently no public reports of CVE-2026-66066 being exploited in the wild, but given how severe the flaw is, and the fact that working exploit material is starting to circulate, affected users should patch and investigate quickly.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!