A booby-trapped image upload can now steal your Rails app's secret keys — no login needed

CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no… Aliteq Priya Nair · Software & Systems Editor

CVE-2026-66066, nicknamed KindaRails2Shell, scores 9.5 on CVSS 4.0 — a pre-authentication arbitrary file read in Active Storage's image processing.

It's exploitable when an app uses libvips (older than version 8.13) for Active Storage image variants and accepts uploads from untrusted users.

Affects Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5, and 8.1.0–8.1.3 by default; Rails 6.0.0–6.1.7.10 only if Active Storage was configured outside its defaults.

Fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 — but you also need libvips 8.13+ and ruby-vips 2.2.1+, or the framework patch alone isn't enough.

Ethiack estimates 500,000+ sites are potentially exposed. No confirmed in-the-wild exploitation as of disclosure, but public PoC code followed within two days.

A 9.5 on CVSS 4.0 is reserved for bugs that need nothing from the attacker — no account, no auth token, no social engineering — and can still reach something serious. This clears that bar twice:…

Why 9.5 is the right number

Read the full story

Aliteq A booby-trapped image upload can now steal your Rails app's secret keys — no login needed Read the full story on Aliteq