Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)
Rapid7 researchers disclosed a severe vulnerability in Ruby on Rails (CVE-2026-66066) that allows attackers to perform arbitrary file reads and potentially execute code remotely. This flaw affects specific versions of Active Storage when using the Vips image processor with untrusted uploads. Affected versions include < 7.2.3.2, >= 8.0 < 8.0.5.1, and >= 8.1 < 8.1.3.1. Attackers can exploit this by crafting malicious MATLAB/HDF5 files uploaded via direct endpoints, leading to exposure of sensitive data like secret keys and enabling further attacks such as remote code execution. Rapid7 has developed a Metasploit module demonstrating exploitation. Patches are now available; users should update immediately.
Overview
On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are < 7.2.3.2, >= 8.0, < 8.0.5.1, and >= 8.1, < 8.1.3.1. Vips is the default Active Storage variant processor for applications that load Rails 7.0 or later defaults. Rails 6 applications are affected only when they explicitly configure Vips.…