KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
A critical vulnerability, CVE-2026-66066, was disclosed in Ruby on Rails on July 29, 2026, impacting applications using the libvips image processing library with Active Storage. This flaw allows unauthenticated attackers to read files accessible by the application process, potentially leading to remote code execution (RCE). The issue affects Rails 7.0 and newer versions where libvips is the default image processor. Affected organizations are urged to update to fixed versions like 7.2.3.2, 8.0.5.1, or 8.1.3.1, along with ensuring libvips is at least version 8.13. Applications using ImageMagick instead of libvips are not impacted.
Overview
On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066">CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classified as Initialization of a Resource with an Insecure Default (CWE-1188). An unauthenticated attacker may be able to leverage CVE-2026-66066 and read files accessible to the Rails application process, potentially exposing secrets that could enable remote code execution (RCE) or access to connected systems.…