KindaRails2Shell: Critical Vulnerability in Ruby on Rails (CVE-2026-66066)

A critical vulnerability threatens Ruby on Rails applications

A serious security flaw, identified as CVE-2026-66066 and nicknamed "KindaRails2Shell," affects Ruby on Rails, one of the most widely used frameworks for developing websites and applications. This vulnerability could allow attackers to access sensitive files on servers or, in some cases, take complete control of the system. The threat is particularly concerning because it exploits a common function: image uploads.

How the vulnerability works

Many applications allow users to upload images, which are then resized and displayed. Ruby on Rails handles this process through Active Storage, an integrated component that relies on the libvips library for image resizing. The problem lies in libvips' ability to open not only standard image files but also specialized formats such as MATLAB files, medical NIfTI scans, SVG, and PDF.

Some tools used by libvips to open these formats are not secure when processing files from untrusted sources. Attackers can exploit this weakness by creating files that appear to be harmless images but contain hidden instructions to read arbitrary files on the server. This could include encryption keys and access credentials, opening the door to further attacks.

Who is at risk

Applications based on Ruby on Rails are vulnerable if:

• They use Active Storage with the default image processor "vips," standard since the release of Rails 7.
• They allow users to upload images through specific features or direct uploads.
• They run versions of Active Storage 7.0 prior to 7.2.3.2, versions 8.0 prior to 8.0.5.1, or versions 8.1 prior to 8.1.3.1.

Applications using the alternative processor "ImageMagick" instead of "vips" are not affected. Additionally, Rails 6.0.0 through 6.1.7.10 installations are vulnerable only if Active Storage has been configured non-standardly.

Discovery and solution

The vulnerability was initially identified and reported by the research team Ethiack, composed of André Baptista, Bruno Mendes, and Rafael Castilho, and independently by the research team of GMO Flatt Security, led by RyotaK. Ruby on Rails released a patch on July 29, 2026, in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.

Affected users were advised to upgrade to the correct versions, update libvips to version 8.13 or later, and regenerate the application's main keys, database credentials, storage service keys, and third-party service tokens.

For those using libvips version below 8.13, no alternative solutions are available other than removing the dependency on libvips. For those using libvips 8.13 or later, it is possible to disable unsafe operations by setting the environment variable VIPSBLOCKUNTRUSTED.

Protection and detection

The Ruby on Rails team and Ethiack initially delayed the disclosure of technical details and exploit code to allow users to apply patches. However, other researchers reverse-engineered the attack and published proof-of-concept, prompting Ethiack to publish a technical deep dive.

The Ruby on Rails team also released two detection and investigation tools that can be used to verify if an application has been exposed to the vulnerability and if someone has taken advantage of it. These tools include an explanation of the attack and a document explaining how to investigate a potential intrusion.

As of now, there are no public reports of CVE-2026-66066 being exploited in the wild, but given the severity of the flaw and the circulation of exploit material, affected users should act quickly to apply patches and conduct investigations.

The importance of proactive cybersecurity

This vulnerability underscores the importance of keeping systems up-to-date and adopting proactive security practices. Applications that allow file uploads must implement strict controls to prevent the upload of malicious files. Additionally, regularly rotating credentials and using robust encryption keys can mitigate the risk of compromise.

Additional protection with Web Application Firewalls

Security provider Akamai coordinated with Ethiack to prepare protections for its customers and implemented specific web application firewall (WAF) rules to counter the KindaRails2Shell attack. However, both Akamai and Ethiack researchers emphasized that a WAF cannot replace patch application.

While WAFs can identify and block known exploitation patterns, the most effective defense remains the timely application of vendor-provided patches and the rotation of any compromised credentials.

The KindaRails2Shell vulnerability represents a significant threat to Ruby on Rails applications. Its ability to allow access to sensitive files or even take complete control of the system underscores the need for immediate action. Investing in security solutions, training, and dependency management can help mitigate risks and protect applications from future threats.