KindaRails2Shell: Critical RCE in Rails via Active Storage (CVE-2026-66066)

A critical remote code execution vulnerability dubbed KindaRails2Shell (CVE-2026-66066) affects Ruby on Rails applications using Active Storage with the default libvips image processor. Discovered independently by Ethiack and GMO Flatt Security researchers, this flaw allows unauthenticated attackers to read arbitrary files and potentially achieve remote code execution on Rails 7.x and 8.x applications that accept image uploads from untrusted users.

Vulnerability Details

CVE ID: CVE-2026-66066 GHSA ID: GHSA-xr9x-r78c-5hrm Severity: Critical Affected Component: Active Storage (activestorage gem) with libvips processor Affected Versions: Rails 7.0.0-7.2.3.1, 8.0.0-8.0.5, 8.1.0-8.1.3 Patched Versions: 7.2.3.2, 8.0.5.1, 8.1.3.1 Attack Vector: Image upload -> variant processing -> arbitrary file read -> RCE Authentication Required: None (unauthenticated in default configurations)

Root Cause Analysis

The vulnerability stems from how Active Storage handles image variant processing with libvips. By default, Rails 7.0+ configures config.active_storage.variant_processor = :vips. libvips uses "loaders" and "savers" backed by third-party libraries to read and write image formats. Some of these operations are marked as "unfuzzed" - unsafe for untrusted content - and handle formats unrelated to web images (e.g., TIFF, PDF, SVG with external entities).

Active Storage did not disable these unfuzzed operations. When an attacker uploads a crafted malicious image file and triggers variant generation (e.g., thumbnail creation), libvips processes the file using unsafe operations, leading to arbitrary file read. The process environment - which typically contains secret_key_base and credentials for external systems - can be exfiltrated, enabling escalation to remote code execution or lateral movement.

The eThiack research team (Andre Baptista, Bruno Mendes, Rafael Castilho) named it KindaRails2Shell because it follows a similar pattern to the recent WP2Shell WordPress vulnerability: image upload -> processing -> shell. However, several requirements must align: default vips processor, untrusted image uploads, and a libvips build linked against certain third-party libraries.

Affected Systems

Rails Version Range	Fixed In	Notes
6.0.0 - 6.1.7.10	7.2.3.2	Non-default config required
7.0.0 - 7.2.3.1	7.2.3.2	Default config affected
8.0.0 - 8.0.5	8.0.5.1	Default config affected
8.1.0 - 8.1.3	8.1.3.1	Default config affected

Only the Vips image processor is affected. Applications using ImageMagick (:magick processor) are not vulnerable via this vector.

An application is exploitable only if all of these conditions are met:

1. Uses libvips for Active Storage image processing (default since Rails 7.0)
2. Accepts image uploads from untrusted users (avatars, profile pictures, attachments)
3. Runs a libvips build linked against vulnerable third-party libraries

Impact Assessment

Arbitrary File Read: Attackers can read any file accessible to the Rails process user, including:

• secret_key_base (enables session forgery, signed cookie tampering)
• Database credentials, API keys, cloud provider tokens
• Application source code and configuration files
• SSH keys, TLS certificates

Remote Code Execution: With access to secret_key_base and environment credentials, attackers can:

• Forge signed cookies to escalate privileges
• Authenticate to external services (AWS, databases, payment processors)
• Pivot to internal systems via stolen credentials
• In certain configurations, achieve direct RCE through deserialization gadgets

No Authentication Required: In default Rails 7.x/8.x configurations with public upload endpoints, the attack is unauthenticated. Rails 6.x requires non-default Active Storage configuration.

Mitigation & Patching

Immediate Upgrade (Primary Fix)

Upgrade to a patched activestorage version immediately:

Run:

libvips Version Requirement (Critical)

The fix requires libvips >= 8.13. Earlier versions cannot disable unfuzzed operations, and Active Storage will raise an exception on boot if libvips < 8.13 is detected.

Check your libvips version:

On Ubuntu/Debian:

On Alpine:

Emergency Mitigation (If Upgrade Delayed)

If immediate upgrade is impossible, set the VIPS_BLOCK_UNTRUSTED environment variable (requires libvips >= 8.13):

Or in a Rails initializer (requires ruby-vips >= 2.2.1):

Post-Exploitation: Rotate All Secrets

Upgrading closes the vulnerability but does not undo exfiltration. If you suspect compromise:

1. Regenerate secret_key_base: rails secret
2. Rotate all database passwords, API keys, cloud credentials
3. Revoke and reissue SSH keys and TLS certificates
4. Audit logs for suspicious variant generation requests

Detection

Indicators of Compromise

Monitor for unusual Active Storage variant processing:

• Variant generation requests for non-image files (check content_type anomalies)
• Spikes in ActiveStorage::Variant records
• Unexpected file reads in application logs (libvips may log format detection)

Log Analysis

Check Rails logs for variant processing errors or unusual parameters:

WAF Rules

While not a substitute for patching, WAF rules can block known malicious payloads:

• Block uploads with mismatched file extensions/signatures
• Restrict upload endpoints to authenticated users only
• Rate-limit variant generation endpoints

Frequently Asked Questions

Is my Rails 6.x application affected?

Only if you customized Active Storage outside its defaults to accept untrusted image uploads. A standard Rails 6.x install is not exposed.

Does this affect applications using ImageMagick?

No. Only the Vips processor (config.active_storage.variant_processor = :vips) is affected. ImageMagick-based processing is not vulnerable via this vector.

Can a WAF fully protect me?

No. A WAF may buy time in specific deployments, but its effectiveness varies based on where Active Storage files are stored and how uploads reach the application. Treat it as a temporary layer, not a fix.

What if I can't upgrade libvips to 8.13+?

You must upgrade libvips. Active Storage will refuse to boot with libvips < 8.13 on patched Rails versions, as the environment is fundamentally unsecurable.

Are there any public exploits?

As of July 30, 2026, the researchers are withholding technical details and PoC to allow users time to patch. However, assume attackers with AI tooling can reconstruct the chain quickly once patches ship and diffs go public.

Key Takeaways

• CVE-2026-66066 (KindaRails2Shell) is a critical RCE chain in Rails Active Storage via libvips unfuzzed operations
• Default Rails 7.x/8.x configs are vulnerable if they accept image uploads from untrusted users
• Upgrade immediately to 7.2.3.2, 8.0.5.1, or 8.1.3.1 with libvips >= 8.13
• Rotate all secrets post-upgrade - upgrading does not undo prior exfiltration
• No public PoC yet, but assume rapid weaponization once diffs are public

Conclusion

KindaRails2Shell demonstrates how default framework configurations combined with third-party library supply chains can create critical attack surfaces. Rails developers should upgrade immediately, verify libvips versions, and treat any image upload endpoint as a potential RCE vector until fully patched. The coordinated disclosure by Ethiack and GMO Flatt Security gave the community a patching window - use it.

---

Sources: eThiack Research, GitHub Security Advisory GHSA-xr9x-r78c-5hrm, Ruby on Rails Discussions, GMO Flatt Security Blog