libvips

2 articles · newest first

Software

A booby-trapped image upload can now steal your Rails app's secret keys — no login needed

CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.

Priya Nair · Aug 5 · 7 min

Software

a Rails image upload bug lets a file lie about what it is — and steal your app's secret keys

KindaRails2Shell abuses a file that tells two different libraries two different lies to read anything your Rails app can read — including the keys that sign its cookies.

Priya Nair · Aug 1 · 6 min