KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
PoC publicActive StorageOur summary
A critical vulnerability, CVE-2026-66066, was disclosed in Ruby on Rails on July 29, 2026, impacting applications using the libvips image processing library with Active Storage. This flaw allows unauthenticated attackers to read files accessible by the application process, potentially leading to remote code execution (RCE). The issue affects Rails 7.0 and newer versions where libvips is the default image processor. Affected organizations are urged to update to fixed versions like 7.2.3.2, 8.0.5.1, or 8.1.3.1, along with ensuring libvips is at least version 8.13. Applications using ImageMagick instead of libvips are not impacted.
Below is the opening; the full story is at Rapid7 Blog.
From Rapid7 Blog
Overview
On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066">CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classified as Initialization of a Resource with an Insecure Default (CWE-1188). An unauthenticated attacker may be able to leverage CVE-2026-66066 and read files accessible to the Rails application process, potentially exposing secrets that could enable remote code execution (RCE) or access to connected systems.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.