A critical vulnerability in the Active Storage framework of the Rails web application framework, identified as CVE-2026-66066, could allow an unauthenticated attacker to read arbitrary files and potentially achieve remote code execution (RCE). Rails, an open-source Ruby-based framework, uses Active Storage for handling file uploads and attachments.
The vulnerability is exploitable when Active Storage is configured to use the `libvips` image processing library for generating image thumbnails. Attackers can upload a specially crafted image to a vulnerable application, enabling them to read arbitrary files on the server. A prerequisite for this attack is that the server must permit image uploads from untrusted users. If these conditions are met, an attacker could access sensitive application files, including the process environment, which commonly contains the `secret_key_base` and credentials for databases, cloud storage, and other services.
The Rails team has confirmed that CVE-2026-66066 affects Active Storage versions prior to 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. Rails 6.x is only vulnerable if Active Storage has been configured with non-default settings. The `libvips` library is the default image processor in official Rails Docker images, as well as in Debian and Ubuntu setups. Users of ImageMagick are not affected by this specific vulnerability vector.
To mitigate the risk, the Rails team recommends upgrading `libvips` to version 8.13 or later. Additionally, administrators should rotate critical secrets, including the `secret_key_base` (the Rails master key), database credentials, Active Storage service credentials, and any other secrets accessible to the application process. For systems running `libvips` 8.13 or newer, a temporary workaround involves setting the `VIPS_BLOCK_UNTRUSTED` environment variable or calling `Vips.block_untrusted(true)` when using `ruby-vips` 2.2.1 or newer. No workaround is available for applications using `libvips` versions older than 8.13.
Security researchers from Ethiack and GMO Flatt Security Inc. discovered and responsibly reported the vulnerability to the Rails team. Initially, technical details were withheld to allow users time to apply updates, with a full disclosure planned for August 28. However, due to the rapid emergence of public proof-of-concept (PoC) exploits, the maintainers decided to release full technical details and forensic investigation tools sooner.
Security firm Akamai has also issued a warning about CVE-2026-66066, dubbing the attack chain "KindaRails2Shell" and highlighting its RCE potential. Akamai explains that compromising the `secret_key_base` grants an attacker the master cryptographic key to the application, enabling them to forge session cookies, sign global IDs, and manipulate serialized data, which can lead directly to full RCE on the underlying server. Akamai coordinated with Ethiack before public disclosure to prepare and release web application firewall (WAF) protections for its customers.
Ethiack has noted that while a WAF might provide some temporary protection, attackers utilizing AI tooling could potentially reconstruct the attack chain based on patch differences.
