Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...

Arbitrary File Read

Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

Exploit for CVE-2026-66066

KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...

CVE-2026-66066

A flaw was found in Active Storage, a component of Action Pack. An unauthenticated attacker can exploit this vulnerability by crafting a malicious file upload. This allows the attacker to invoke unsafe libvips operations, leading to the ability to read arbitrary files on the system including...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066

CVE-2026-66066 affects Ruby on Rails with Active Storage using libvips. In vulnerable releases (prior to fixed versions on each line), Active Storage does not disable unsafe libvips operations during image processing, allowing an unauthenticated attacker uploading crafted images to read arbitrary...

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

GHSA-XR9X-R78C-5HRM Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...

KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classifi...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties through the Vips analyzer and Vips transformer in vips.rb. An attacker can read files from the server, including process environment variables, by uploading a crafted image and causing...

PT-2026-66655

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret key base and often credentials for external systems, whic...