active-storage

2 articles · newest first

Developer typing code on a laptop screen showing a web application

A booby-trapped image upload can now steal your Rails app's secret keys — no login needed

CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.

Priya Nair · Aug 5 · 7 min

Ruby on Rails application code displayed on a developer's monitor

Software

a Rails image upload bug lets a file lie about what it is — and steal your app's secret keys

KindaRails2Shell abuses a file that tells two different libraries two different lies to read anything your Rails app can read — including the keys that sign its cookies.

Priya Nair · Aug 1 · 6 min