PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-66066] KindaRails2Shell: How a MATLAB file reads your secrets and pops a shell on Rails

ethiack.com | research | CVE-2026-66066 | #rce | #ruby-on-rails | #libvips | #file-read | #cve-2026-66066
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A technical deep-dive into CVE-2026-66066, where a malformed MATLAB file slips past libvips handling in Rails ActiveStorage to achieve arbitrary file read and unauthenticated RCE on default setups.
CVE
CVE-2026-66066
Collected

Related coverage

Critical · vulnerability · ethiack.com
KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)
A default Rails image-processing path can expose process secrets and lead to remote code execution. Defenders must upgrade both Active Storage and libvips, then rotate any secrets that may already have been readable.
tool · github.com
CVE-2026-66066 PoC: Rails Active Storage file-read-to-RCE chain
The public PoC turns the disclosure into a reproducible exploit chain, lowering the barrier to reproduction. Defenders should upgrade Rails and libvips promptly and run this tool only in isolated, authorized local environments.
research · swarm.ptsecurity.com
Grafana 6.4.3 Arbitrary File Read
CVE-2019-19499 in Grafana 6.4.3: a rogue MySQL data source answers LOCAL INFILE requests to exfiltrate arbitrary files from the Grafana host, turning the 'add a data source' feature into an authenticated arbitrary file read.
research · swarm.ptsecurity.com
Vulnerabilities in the Openfire Admin Console
Two vulnerabilities in the Openfire Admin Console: an unauthenticated full-read SSRF through FaviconServlet (CVE-2019-18394) that can reach internal services, and a Windows-only arbitrary file read via PluginServlet path handling (CVE-2019-18393) that requires an admin account.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Back