a Rails image upload bug lets a file lie about what it is — and steal your app's secret keys

KindaRails2Shell abuses a file that tells two different libraries two different lies to read anything your Rails app can read — including the keys… Aliteq Priya Nair · Software & Systems Editor

CVE-2026-66066 (CVSSv4 9.5) is an arbitrary file-read bug in Rails Active Storage's image variant processing, found by Ethiack and GMO Flatt Security.

It affects Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1 by default — plus Rails 6.x if Active Storage was set up to use libvips.

A crafted upload can make the app read arbitrary server files, including secret_key_base and the Rails master key, which can chain into full remote code execution.

Fixed in Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1 — but you also need libvips 8.13 or later, or the Rails patch alone won't close the hole.

Rails pushed technical details and forensic tooling out four weeks early, on July 31, after proof-of-concept code began circulating ahead of the planned August 28 coordinated disclosure.

This runs by default under Rails' most common upload pattern — not a misconfiguration, not an edge-case plugin. If your app accepts an image upload anywhere and you haven't checked your Active…

The part that should worry you more than the CVE score

Read the full story

Aliteq a Rails image upload bug lets a file lie about what it is — and steal your app's secret keys Read the full story on Aliteq