Rails has released security updates for a critical Active Storage vulnerability that can let unauthenticated attackers read arbitrary files from vulnerable web applications.
The Rails Active Storage flaw, tracked as CVE-2026-66066, can also create a path to remote code execution. Attackers may steal application secrets first and then use them to take control of the affected server.
Rails developers should apply the available updates as soon as possible, especially if their applications accept image uploads from untrusted users.
CVE-2026-66066 affects Rails apps using libvips
Active Storage is Rails’ built-in component for handling file uploads and attachments. It can also generate image thumbnails through processors such as libvips and ImageMagick.
According to the Rails security advisory, attackers can exploit CVE-2026-66066 when an application uses libvips to process uploaded images.
An attacker can upload a specially crafted image and use it to read files from the server. However, the attack requires the application to allow image uploads from untrusted users.
ImageMagick users do not face this specific attack vector. Still, libvips acts as the default image processor in official Rails Docker images and many Debian and Ubuntu deployments.
Stolen secrets could lead to remote code execution
The file-reading issue can expose sensitive files from the application environment.
Attackers may access the process environment, which often contains the secret_key_base value. They may also obtain database passwords, cloud-storage credentials and Active Storage service credentials.
The secret_key_base acts as a core cryptographic secret for a Rails application. Akamai warned that attackers who obtain it could forge session cookies, sign global IDs and manipulate serialised data.
Those actions can give an attacker a route to full remote code execution on the underlying server. Akamai has named the attack chain “KindaRails2Shell.”
Which Rails versions need updates?
The Rails Active Storage flaw affects Active Storage versions before the following releases:
- Rails 7.2.3.2
- Rails 8.0.5.1
- Rails 8.1.3.1
Rails 6.x installations only face risk when administrators configured Active Storage outside its default settings.
Rails maintainers advise administrators to upgrade libvips to version 8.13 or later. They should also rotate every secret the affected application process could access.
That includes the Rails secret_key_base, database credentials, Active Storage service credentials and cloud-service keys.
Temporary mitigations are available for newer libvips versions
Administrators who already run libvips 8.13 or later can temporarily block the vulnerable functionality.
They can set the VIPS_BLOCK_UNTRUSTED environment variable. Alternatively, applications that use ruby-vips 2.2.1 or newer can call Vips.block_untrusted(true).
However, applications that use libvips versions older than 8.13 do not have a workaround. In those cases, administrators need to upgrade their libraries and patch Rails without delay.
Public PoCs increase exploitation risk
Rails initially withheld technical details to give users time to patch their systems.
The maintainers had planned to publish full technical information on the Rails forums on August 28. However, public proof-of-concept exploits appeared soon after the advisory.
As a result, the Rails team decided to publish the full details and forensic investigation tools earlier than planned.
Researchers from Ethiack and GMO Flatt Security Inc. discovered and responsibly reported the vulnerability. Ethiack noted that web application firewalls may give administrators extra time, but attackers can likely reconstruct the exploit chain from public patch differences.
Akamai has also released WAF protections for customers. Nevertheless, administrators should treat those protections as an extra layer, not a replacement for patching the Rails Active Storage flaw.
0 responses to “Rails Patches Critical Active Storage Flaw With RCE Risk”