A critical-severity vulnerability in Ruby on Rails, dubbed KindaRails2Shell, is being actively exploited by hackers to steal secrets and execute remote code. Despite patches, some servers remain at risk due to complex deserialization gadgets.
- CVE-2026-66066 carries a critical CVSS score of 9.5, allowing unauthenticated Remote Code Execution (RCE).
- The flaw stems from a discrepancy in how libvips and Rails handle file types during image processing.
- Attackers can read sensitive server files, including credential databases and storage keys.
- VulnCheck reports that approximately 7,000 exposed instances were identified in early August.
Cybersecurity experts have issued an urgent warning regarding a critical vulnerability in the Ruby on Rails framework, tracked as CVE-2026-66066. The flaw, popularly known as KindaRails2Shell, allows an unauthenticated attacker to perform arbitrary file reads, which can subsequently lead to the exposure of critical system secrets and full Remote Code Execution (RCE).
The vulnerability is rooted in a technical conflict between how the Rails framework and the libvips library process image uploads. While Rails relies on client-supplied content types, libvips analyzes "magic bytes" to determine the actual file type. By crafting a malicious file and labeling it as a MATLAB Level 5 file, an attacker can trick the system into routing the file through the libmatio and HDF5 loaders. This chain allows the attacker to specify a path to any file on the server, which is then read and returned as pixel data.
Why This Matters
BozokMedia analysis shows that this is not merely a data leak but a gateway to total system compromise. By extracting storage keys or credential databases, attackers can forge user sessions and move laterally through a corporate network. The ability to execute arbitrary code remotely means that an attacker could potentially install ransomware or exfiltrate proprietary data without any valid credentials.
The danger of KindaRails2Shell lies in the 'double confusion' across library layers, turning a simple image upload into a powerful server-side read primitive.
Although patches were released in late July, VulnCheck has reported that active exploitation began in August, roughly a month after the fix. More alarmingly, research suggests that while the primary libvips file read is blocked in version 8.1.3.1, a specific variation-key Marshal deserialization gadget may still allow RCE if a valid signature is present, suggesting the fix may not be entirely comprehensive for all attack vectors.
Historically, Ruby on Rails has faced similar challenges with deserialization and file handling vulnerabilities, but the complexity of modern image processing libraries like libvips adds a new layer of risk. The rapid release of Proof-of-Concept (PoC) code by researchers has significantly lowered the barrier for entry for threat actors.
| Feature | Unpatched State | Patched State (8.1.3.1) |
|---|---|---|
| libvips File Read | Fully Vulnerable | Blocked |
| Secret Exposure | High Risk | Low Risk |
| Marshal Deserialization | Vulnerable | Potentially Vulnerable (with signature) |
Frequently Asked Questions
Q1: Who is most at risk from KindaRails2Shell?
Any Ruby on Rails application that uses libvips for Active Storage image processing and allows image uploads from untrusted users is at high risk.
Q2: How can administrators detect if they have been exploited?
Rails has published specific forensic tools designed to scan logs and system states for indicators of compromise related to this flaw.
