KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)

CVE

CVE-2026-66066

Vendor

Ruby on Rails

Product

Active Storage

Affected versions

Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13

CVSS

9.5

Published

2026-07-29 00:00

Collected

2026-07-30 09:03

---
id: 5570
title: "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)"
cve: CVE-2026-66066
cvss: 9.5
severity: critical
vendor: "Ruby on Rails"
product: "Active Storage"
affected_versions: "Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13"
source_domain: ethiack.com
source_url: "https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066"
published_at: "2026-07-29T00:00:00Z"
tags: ["rce", "ruby-on-rails", "active-storage", "libvips", "arbitrary-file-read", "featured", "cve-2026-66066", "ethiack"]
phying_url: "https://phying.com/item/5570"
lang: en
---

# KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)

## Summary

Ethiack research team discovered KindaRails2Shell (CVE-2026-66066): a critical RCE in Ruby on Rails via Active Storage. 500,000+ sites affected. Find out if you are and how to mitigate.

## Why it matters

A default Rails image-processing path can expose process secrets and lead to remote code execution. Defenders must upgrade both Active Storage and libvips, then rotate any secrets that may already have been readable.

## Intelligence Metadata

- **Sources:** ethiack.com
- **CVE:** CVE-2026-66066
- **CVSS:** 9.5
- **Vendor:** Ruby on Rails
- **Product:** Active Storage
- **Affected versions:** Active Storage < 7.2.3.2; >= 8.0 and < 8.0.5.1; >= 8.1 and < 8.1.3.1; libvips must be >= 8.13
- **Published:** 2026-07-29T00:00:00Z
- **Original:** https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066
- **Phying News:** https://phying.com/item/5570