A critical vulnerability, identified as CVE-2026-66066 and dubbed ‘KindaRails2Shell,’ has been discovered in Ruby on Rails’ Active Storage component. This flaw specifically affects deployments utilizing the libvips image-processing library and accepting uploads from untrusted users. The vulnerability could potentially allow unauthenticated attackers to read files accessible to the Rails application process by submitting specially crafted uploads.
The root cause lies in Active Storage’s image variant processing, which failed to block certain unsafe libvips operations when handling untrusted content. This oversight enables attackers to access sensitive files, including environment variables, configuration files, database passwords, API tokens, and AWS access credentials. For organizations hosting customer platforms on Amazon Web Services (AWS), the implications are particularly severe. Compromised cloud credentials could grant attackers access to S3 buckets, databases, backups, application logs, and other connected services, depending on the permissions assigned to the compromised identity.
Furthermore, if a Rails application stores the `secret_key_base` in environment variables, an attacker gaining access to this secret could forge Rails-signed data and potentially execute remote code on the server. This access would occur using the permissions assigned to the Rails process, potentially leading to further data theft, changes in application behavior, or exploitation of cloud services associated with the environment.
The vulnerability affects Rails versions prior to Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1. Rails 6 applications may also be at risk if administrators have manually configured Active Storage to use the Vips processor. A proposed Metasploit module on GitHub demonstrates how attackers could chain file access and forged image data to achieve command execution. This module has reportedly been tested in controlled environments against Rails versions 6.0.6.1, 6.1.7.10, and 8.0.5, highlighting the urgency for organizations to identify exposed Rails services and apply necessary updates.
Security teams should take immediate action to patch vulnerable Rails deployments, review Active Storage upload endpoints, rotate Rails secrets and AWS credentials if exposure is suspected, and audit AWS CloudTrail, S3, and application logs for any unusual access. Companies should also enforce least-privilege IAM roles and avoid storing long-lived cloud secrets in process environment variables.
This vulnerability underscores the critical importance of securing cloud-based applications and the potential risks associated with handling untrusted user inputs. Organizations must remain vigilant in applying security updates and reviewing their configurations to prevent unauthorized access and data breaches.
