Rails patches critical Active Storage flaw with RCE potential
A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE).
Intelligence analysis by Llama
Rails has patched a critical vulnerability in Active Storage that could allow an attacker to read arbitrary files and potentially execute code remotely. The vulnerability affects Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1.
Imagine you have a website that lets people upload pictures. If someone finds a way to trick the website into showing them a secret picture, they might be able to see some private information. This is like a digital key that unlocks a secret door. If someone finds the key, they can open the door and see what's inside. The people who made the website are trying to fix this problem so that no one can see the secret information.
Analysis
A Critical Vulnerability in Active Storage
A critical vulnerability in the Active Storage framework has been patched by Rails. This vulnerability, identified as CVE-2026-66066, can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE).
Active Storage is a built-in component of the Rails framework that handles file uploads and attachments. It uses image processing libraries such as libvips or ImageMagick to generate image thumbnails from uploaded media. However, when libvips is used, an attacker can upload a specially crafted image to a vulnerable application and read arbitrary files on the server.
The vulnerability is exploitable when libvips is used, and the server allows image uploads from untrusted users. If these requirements are met, an attacker may access app files, including the process environment, which typically contains ‘secret_key_base’ and credentials for databases, cloud storage, and other services.
CVE-2026-66066 impacts Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. Rails 6.x is only affected if Active Storage has been configured outside its defaults.
The Rails team recommends upgrading to libvips 8.13 or later and rotating the ‘secret_key_base’ (the Rails master key), database credentials, Active Storage service credentials, and any other secrets accessible to the application process. For systems running libvips 8.13 or later, administrators can temporarily disable the vulnerable functionality by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) when using ruby-vips 2.2.1 or newer.
There is no workaround available for apps that use libvips before 8.13. ImageMagick users are not affected by this vector. However, libvips is the default processor in the official Rails Docker images, and also Debian and Ubuntu setups.
The Rails team said it has intentionally withheld technical details for the vulnerability to reduce the risk of exploitation before users have time to apply the updates. Full technical details were initially scheduled to be disclosed on August 28 on the Rails forums. However, because public proof-of-concept (PoC) exploits became available very quickly, the maintainers decided to publish the full details as well as forensic investigation tooling.
The vulnerability was discovered and responsibly reported to the Rails team by researchers from Ethiack and GMO Flatt Security Inc. Security firm Akamai has also published a warning about CVE-2026-66066, naming the attack chain “KindaRails2Shell,” and warning about its RCE potential.
“With the secret_key_base compromised, the attacker holds the master cryptographic key to the application,” explains Akamai. “They can forge session cookies, sign global IDs, and manipulate serialized data, which directly translates into full RCE on the underlying server.”
Akamai says it coordinated with Ethiack before public disclosure to prepare protections for customers, and has now released web application firewall (WAF) protections. Ethiack noted that a WAF might buy admins some time, but attackers using AI tooling should be able to reconstruct the attack chain based on the patch diffs.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper
Key points
- A critical vulnerability in Active Storage has been patched by Rails.
- The vulnerability can allow an unauthenticated attacker to read arbitrary files from a Rails application and potentially escalate to remote code execution (RCE).
- CVE-2026-66066 impacts Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1.
- The Rails team recommends upgrading to libvips 8.13 or later and rotating the ‘secret_key_base’ (the Rails master key), database credentials, Active Storage service credentials, and any other secrets accessible to the application process.
- Security firm Akamai has released web application firewall (WAF) protections to help customers defend against this type of attack.
The Rails team has patched the vulnerability and provided guidance on how to upgrade and secure the application. This should help prevent attacks and protect sensitive information. Additionally, security firms like Akamai have released web application firewall (WAF) protections to help customers defend against this type of attack.
The vulnerability was discovered and exploited quickly, which means that attackers may have already found ways to exploit it. This could lead to a breach of sensitive information and potentially allow attackers to execute code remotely. Additionally, the fact that public proof-of-concept (PoC) exploits became available very quickly means that attackers may be able to reconstruct the attack chain based on the patch diffs.
