Critical Remote Code Execution Vulnerability in Ruby on Rails Active Storage (CVE‑2026‑66066) – Advisory and Mitigation

by

Overview

On 29 July 2026 a critical vulnerability (CVE‑2026‑66066, nicknamed “KindaRails2Shell”) was disclosed affecting Ruby on Rails’ Active Storage component. An attacker who can upload a crafted file may read arbitrary files on the server and achieve remote code execution (RCE).

Affected Components

  • activestorage < 7.2.3.2
  • activestorage 8.0 – 8.0.5.1 (pre‑8.0.5.1)
  • activestorage 8.1 – 8.1.3.1 (pre‑8.1.3.1)

Conditions Required for Exploitation

  1. Active Storage is configured to process images with libvips (variant processor set to :vips).
  2. The application accepts image uploads from untrusted users (direct upload or regular upload endpoint).
  3. The libvips installation uses a third‑party loader that is classified as “unfuzzed” for untrusted content.

Rails 6.0.0‑6.1.7.10 may be vulnerable if Active Storage is set up with non‑default configurations (per Ethiack). Versions prior to Rails 6.0.0 are reported as not vulnerable (per GMO Flatt).

Exploit Availability

Public proof‑of‑concept (PoC) code and exploit scripts have been released (GitHub advisory GHSA‑xr9x‑r78c‑5hrm, Ethiack blog, Flatt Security blog). JPCERT confirms that exploit code is publicly available, raising the likelihood of active attacks.

Mitigation and Patch

Apply the latest Rails update that addresses the issue. When upgrading, note the following:

  • If libvips is below 8.13 or ruby‑vips is below 2.2.1, Active Storage will raise an exception on startup. Upgrade libvips to ≥ 8.13 and ruby‑vips to ≥ 2.2.1 before applying the Rails patch.

For environments that cannot patch immediately, the advisory recommends ensuring libvips ≥ 8.13 or ruby‑vips ≥ 2.2.1 as a temporary mitigation. WAF protection is considered limited and should not replace a proper patch.

Detection (Forensic Investigation)

The Rails team has published forensic tools and a guide (GitHub repository rails-forensics-CVE-2026-66066) to help identify compromise. Review the discussion thread on Ruby on Rails Discussions for detailed attack indicators.

References