Rails patches critical Active Storage flaw with RCE potential

Published:

1 augustus 2026 om 16:20:30

Alert date:

1 augustus 2026 om 17:00:27

Source:

bleepingcomputer.com

Web Technologies, Zero-Day Vulnerabilities, Supply Chain & Dependencies

A critical vulnerability has been discovered in the Active Storage framework used by Ruby on Rails applications. The flaw allows unauthenticated attackers to read arbitrary files from a Rails application server. Beyond file disclosure, the vulnerability carries the potential to escalate to remote code execution (RCE), making it particularly severe. Rails has released patches to address the issue. The vulnerability poses significant risk to any Rails application using Active Storage, which is a widely adopted framework component for handling file uploads and attachments. Organizations running Rails applications are urged to apply the patches immediately. No CVE identifier is explicitly mentioned in the provided content.

Technical details

CVE-2026-66066 is a critical vulnerability in the Rails Active Storage framework. It is exploitable when the libvips image processing library is used for generating thumbnails from uploaded media. An unauthenticated attacker can upload a specially crafted image to a vulnerable Rails application where image uploads from untrusted users are allowed. This allows the attacker to read arbitrary files on the server, including the process environment which typically contains 'secret_key_base' and credentials for databases, cloud storage, and other services. With 'secret_key_base' compromised, attackers can forge session cookies, sign global IDs, and manipulate serialized data, enabling full Remote Code Execution (RCE) on the underlying server. Akamai has named the attack chain 'KindaRails2Shell'. ImageMagick users are NOT affected by this vector. libvips is the default processor in official Rails Docker images and Debian/Ubuntu setups. Public proof-of-concept (PoC) exploits became available shortly after initial disclosure, prompting the Rails team to release full technical details and forensic investigation tooling ahead of schedule.

Mitigation steps:

1. Upgrade Active Storage to patched versions: 7.2.3.2, 8.0.5.1, or 8.1.3.1 as appropriate. 2. Upgrade libvips to version 8.13 or later. 3. Rotate 'secret_key_base' (Rails master key), database credentials, Active Storage service credentials, and all other secrets accessible to the application process. 4. For systems already running libvips 8.13 or later, temporarily disable vulnerable functionality by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) when using ruby-vips 2.2.1 or newer. 5. Note: There is no workaround available for apps using libvips versions before 8.13 — upgrading libvips is required. 6. Deploy WAF protections (Akamai has released WAF rules for this vulnerability). 7. Use the forensic investigation tooling released by the Rails team (https://github.com/rails/rails-forensics-CVE-2026-66066) to investigate potential prior exploitation. 8. Note that ImageMagick users are not affected by this specific attack vector.

Affected products:

Ruby on Rails Active Storage before version 7.2.3.2
Ruby on Rails Active Storage 8.0.x before 8.0.5.1
Ruby on Rails Active Storage 8.1.x before 8.1.3.1
Ruby on Rails 6.x (only if Active Storage configured outside defaults)
libvips before version 8.13
ruby-vips before version 2.2.1