KindaRails2Shell: a Critical RCE Vulnerability in Rails via Active Storage

A team of researchers at Ethiack has reported a critical vulnerability in Ruby on Rails, assigned the identifier CVE-2026-66066 and the catchy name KindaRails2Shell. The problem lies in Active Storage — the framework's built-in mechanism for handling uploaded files and processing images, which is enabled by default in many production applications.

What it's about

The vulnerability affects the combination of Active Storage and the vips image processor — the one shipped by default in the official Rails Docker images, as well as in Debian and Ubuntu. Applications that use Magick instead are not exposed to this vector.

Rails versions 7.0.0–7.2.3.1 and 8.0.0–8.1.3 in their default configuration are at risk. The 6.x branch is vulnerable only if Active Storage was configured in a non-standard way. The condition for exploitation is simple and, unfortunately, common: the application must accept image uploads from untrusted users. According to the authors, almost any feature where a user uploads a picture and the service returns a processed version — avatars, thumbnails, profile photos — is under threat.

The consequences are serious: arbitrary file reads under the identity of the processing process and remote code execution, with the possibility of further lateral movement across the infrastructure. In a number of scenarios, the researchers note, no authentication is required at all.

Who found it and how

The vulnerability was independently discovered by André Baptista, Bruno Mendes and Rafael Castillo of Ethiack, and a few days later by RyotaK of GMO Flatt Security. The teams coordinated disclosure together with the Rails and libvips maintainers. The name KindaRails2Shell is a nod to the wp2shell project that inspired the researchers: a full-fledged “rails2shell” didn't come out, but something similar did — hence the “kinda” prefix.

What to do

The authors are not yet publishing technical details, a PoC or the specifics of the exploitation chain, giving administrators time to update. At the same time, they explicitly warn: once the patches are out and the diffs become available, attackers using AI tools will be able to quickly reconstruct a working exploit, so there's no reason to put off updating.

The main fix is to move to Rails 7.2.3.2, 8.0.5.1, 8.1.3.1 or newer. An important caveat: updating Rails alone is not enough if the installed version of libvips is below 8.13 — older builds simply can't disable the dangerous operations, and Active Storage will throw an exception on upload. In that case you'll also have to update libvips itself, or drop the dependency if it was only used for image analysis.

If you can't update right away, on libvips 8.13+ the VIPS_BLOCK_UNTRUSTED environment variable helps, and with ruby-vips 2.2.1 or newer a call to Vips.block_untrusted(true) in an initializer. A WAF can buy time in certain configurations, but it is not a full replacement for the patch.

Source: Lobsters