KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classifi...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties through the Vips analyzer and Vips transformer in vips.rb. An attacker can read files from the server, including process environment variables, by uploading a crafted image and causing...

PT-2026-66655

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret key base and often credentials for external systems, whic...

Exploit for CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell Pre-Authenticatio...

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 CVSS score: 9.5, the flaw can expose the Rails process environment and secre...

PT-2026-65864

Name of the Vulnerable Software and Affected Versions Ruby on Rails affected versions not specified Description An issue exists in applications using Active Storage with Vips that allows unauthenticated attackers to read server files by uploading crafted images. This could lead to the exposure of...

Possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...

CVE-2026-63765

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...

CVE-2026-63765

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...

GHSA-3MVF-82QP-8QH5 Decidim: Verification documents can be downloaded through reusable links

Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until...

Decidim: Verification documents can be downloaded through reusable links

Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until...

Decidim: Private exports can be downloaded through reusable links

Description The normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Technical description This private export flow turns an authenticated,...

GHSA-767H-63J4-5226 Decidim: Private exports can be downloaded through reusable links

Description The normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Technical description This private export flow turns an authenticated,...

PT-2026-60069

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An issue exists in the download your data flow where the resulting Active Storage blob redirect URL can be replayed without...

Decidim - Private exports can be downloaded through reusable links

Description The normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Impact Personal data exports can be retrieved through leakage channels such ...

The vulnerability of the Active Storage component in the Ruby on Rails software framework allows attackers to trigger a service failure.

The vulnerability of the Active Storage component in the Ruby on Rails software framework is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Unity Linux 20.1060e / 20.1070e Security Update: rubygem-rails (UTSA-2026-016644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016644 advisory. A client side enforcement of server side security vulnerability exists in rails 5.2.4.2 and rails 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length o...

Astra Linux – Vulnerability in Rails

There is a code injection vulnerability in Active Storage version 5.2.0 and later, which could allow an attacker to execute code through imageprocessing arguments...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Orchestrator

Summary Multiple vulnerabilities were addressed in IBM Aspera Orchestrator 4.1.4 Vulnerability Details CVEID:CVE-2026-33173 DESCRIPTION: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, DirectUploadsController...

Rails Active Storage Has A Possible DoS Vulnerability In Proxy Mode Via Multi-range Requests

Impact Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Releases The fixed...