Unsafe by Default: KindaRails2Shell Exposes Ruby on Rails to File Read and RCE

Active Storage never disabled unsafe libvips loaders

The Ruby on Rails project has released fixes for CVE-2026-66066 (KindaRails2Shell), a critical arbitrary file read and remote code execution vulnerability in Active Storage. The flaw stems from Active Storage failing to disable libvips operations that the imaging library itself marks as unsafe for untrusted content. Affected applications use libvips for Active Storage image processing and accept image uploads from untrusted users. Rails selects Vips under load_defaults 7.0, and later defaults retain it.

Unauthenticated file read escalates to secret exposure and RCE

An unauthenticated attacker who can upload an image to an affected Ruby on Rails application can craft a file that libvips will parse through one of these unsafe loaders, causing the application to read a file of the attacker's choosing off the server filesystem and return its contents rendered as image pixels. The files most valuable to an attacker are the ones the Rails process can always reach: the process environment, which typically holds secret_key_base, and the encrypted credentials that the Rails master key unlocks. Once secret_key_base is recovered, the attacker holds the application's master cryptographic key and can forge signed and encrypted material, escalating CVE-2026-66066 into full remote code execution.

The trust boundary between Active Storage and libvips

The root cause of CVE-2026-66066 sits at the trust boundary between Active Storage and libvips rather than in either component's own logic. libvips reads and writes image formats through operations it calls loaders and savers, many of which are backed by third-party libraries and handle formats unrelated to web imagery. libvips itself marks a subset of these operations as unfuzzed, meaning they have not been hardened against hostile input. Since version 8.13, libvips has offered a mechanism to block those operations outright.

No known exploitation, but the vulnerable setting remains widespread

Active Storage never invoked the libvips blocking mechanism, so every unfuzzed loader remained reachable by any file the application handed to the processor. The vulnerable setting is config.active_storage.variant_processor = :vips, which no subsequent Rails default has changed. No threat actor group or malware family has been linked to activity involving CVE-2026-66066, and the Rails Security Team has stated that it is not aware of exploitation attempts before or after disclosure.