A new security flaw, called 'KindaRails2Shell,' has been found in Ruby on Rails, a major framework for building websites and web applications. The vulnerability, assigned the identifier CVE-2026-66066, can let attackers take advantage of a feature that handles image uploads to get access to secret files stored on a server.
Researchers explain that attackers can fool the system by creating and uploading a file that looks like a standard image. When the server tries to process it, the malicious code embedded in the file runs, letting the attacker read any files they want, including sensitive data like passwords and server environment variables.
How Active Storage and libvips enable the flaw
The vulnerability is tied to Ruby on Rails' Active Storage, a component that handles file storage and processing. Active Storage uses an external image-processing library named libvips to resize images and handle other operations.
While Active Storage works well with standard image formats, it also supports less common scientific and medical file types. This includes MATLAB .mat files, NIfTI medical scan files, and others. The issue is that some features of libvips are unsafe when handling user-submitted files. The researchers found that Rails doesn't disable these risky operations by default, which opens the door for exploitation.
In particular, the flaw allows an attacker to create a file that seems like a typical image but hides code that instructs the server to read or modify any files the attacker chooses. This could include secrets used to secure the app and external services.
Which versions are impacted and what to do
Apps that use the default 'vips' image processor in Active Storage are at risk. This includes specific versions of Ruby on Rails, such as 7.0 through 7.2.3.1, 8.0 through 8.0.5, and 8.1 through 8.1.3. Earlier versions of Rails 6.x are generally not affected unless Active Storage has been set up in a non-standard way.
To address the vulnerability, developers are advised to upgrade to the fixed versions of the framework: 7.2.3.2, 8.0.5.1, and 8.1.3.1. It's also important to update libvips to version 8.13 or newer. If that's not possible, removing the libvips dependency entirely from the app is the only alternative.
In addition to patching, it's recommended that users rotate all sensitive keys and credentials. This includes the app's master key, storage service access keys (for services like Amazon S3, Google Cloud Storage, and Azure), and any external service tokens.
Security response and detection methods
The flaw was found and reported independently by two research teams: Ethiack and GMO Flatt Security. Before making the details public, Akamai, a cybersecurity vendor, worked with Ethiack to create web application firewall (WAF) rules that block KindaRails2Shell attacks. These rules are now deployed to help protect users.
However, Akamai and Ethiack both stress that WAF rules should not be relied on as a complete solution. The most secure action is to apply the patches from the Rails team. The Rails core team also developed detection tools to help users find out if they were ever exposed to the vulnerability and what data might have been accessed.
Soon after the flaw was made public, proof-of-concept code for exploiting it was shared online. In response, Ethiack released a detailed explanation of how the attack works. This includes step-by-step breakdowns that help users understand the flaw's potential impact and how to avoid it.
The Rails team also published a repository with detection tools and forensic agents. These tools help users determine if their applications were ever vulnerable and whether attackers successfully exploited the flaw.
The vulnerability highlights the importance of keeping both application code and third-party dependencies updated. The flaw shows how a seemingly minor feature, like image resizing, can become a major security risk if not configured carefully.
Developers using Ruby on Rails should check their app's configuration and ensure they are running the latest versions of both the framework and libvips. Security experts recommend taking all necessary steps to patch the flaw before it can be used in real-world attacks.