KindaRails2Shell

KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-file proof of concept and loopback-only Docker lab for the Rails Active Storage/libvips arbitrary-file-read vulnerability. It also demonstrates the advisory's conditional escalation from a recovered secretkeybase to a forged image variati...

CVE-2019-5420

CVE-2019-5420 CVE-2019-5420 Ruby on Rails For educational purposes only. See Reference for the details. Environment Ruby: 2.6.0p0 Rails: 5.2.2 Run $ docker run --name cve-2019-5420 --rm -p 3000:3000 knqyf263/cve-2019-5420 Exploit Execute touch /tmp/rce $ curl...

CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell Pre-Authentication Remote Code Execution RCE in Ruby on Rails Active Storage Educational security research repository for CVE-2026-66066 "KindaRails2Shell". This repository is intended for security research, vulnerability analysis, detection, and defensive...

rails-forensics-CVE-2026-66066

rails-forensics-CVE-2026-66066 Tooling and method for answering two questions about a Rails application and CVE-2026-66066, the Active Storage and libvips arbitrary file read known as KindaRails2Shell: 1. Was I vulnerable, and for how long? 2. Was I exploited, and if so, what left the building? T...

CVE-2026-66066-POC

PoC for CVE-2026-66066 - Minimal stock Rails/libvips lab This repository reproduces the Rails Active Storage file-read-to-RCE chain described by GHSA-xr9x-r78c-5hrm against Rails 8.1.3, the newest affected Rails 8.1 release. Rails 8.1.3.1 is the patched control. Use it only in the disposable loca...

Active Storage: Possible arbitrary file write and read in image analysis

Impact A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include...

GHSA-F3W6-W445-FWH9 Active Storage: Possible arbitrary file write and read in image analysis

Impact A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include...

EUVD-2026-123002

Action Pack: Possible DoS vulnerability in Action Controller Live streaming...

Action Pack: Possible sensitive session information leak in Active Storage proxy mode

Impact When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret config.actiondispatch.cookiesrotations or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write...

GHSA-X6MJ-8JX9-QHQV Action Pack: Possible sensitive session information leak in Active Storage proxy mode

Impact When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret config.actiondispatch.cookiesrotations or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write...

EUVD-2026-122937

Active Storage: Unsigned Content-Type in GCS direct uploads with cachecontrol...

Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control

Impact When a GCS service is configured with the cachecontrol option, ActiveStorage::Service::GCSServiceurlfordirectupload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosin...

GHSA-3W93-6HMW-WHH4 Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control

Impact When a GCS service is configured with the cachecontrol option, ActiveStorage::Service::GCSServiceurlfordirectupload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosin...

GHSA-3F4Q-8X5M-76V8 Active Storage: Possible local file disclosure in video previews and analysis

Impact Active Storage's VideoPreviewer, VideoAnalyzer and AudioAnalyzer run ffmpeg and ffprobe on a blob's contents without restricting the input format, so FFmpeg selects a demuxer by probing the file. A blob created through a direct upload keeps the content type the client declared, so a client...

EUVD-2026-123059

Active Storage: Possible local file disclosure in video previews and analysis...

Active Storage: Possible local file disclosure in video previews and analysis

Impact Active Storage's VideoPreviewer, VideoAnalyzer and AudioAnalyzer run ffmpeg and ffprobe on a blob's contents without restricting the input format, so FFmpeg selects a demuxer by probing the file. A blob created through a direct upload keeps the content type the client declared, so a client...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips Arbitrary File Read → SECRETKEYBASE Theft → RCE Overview CVE-2026-66066 is a critical-severity CVSS 9.5 pre-authentication arbitrary file read to remote code execution chain in Ruby on Rails Active Storage, affecting Rails 7.2.0–7.2.3...

CVE-2026-126084

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cachecontrol option, ActiveStorage::Service::GCSServiceurlfordirectupload signs direct-upload URL...

CVE-2026-126188

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and...

UBUNTU-CVE-2026-126074

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filenamebase and extensionwithdelimiter, and therefore extension, pass the stored filename unmodified to File.basename and...