The Ruby on Rails project has patched a critical flaw that lets an unauthenticated attacker read files from a vulnerable web application, including the secret keys that protect its user sessions. Tracked as CVE-2026-66066 and scored 9.5 out of 10 on the CVSS v4 scale, the bug sits in Active Storage, the component Rails uses to handle file uploads.
The advisory landed on July 29, 2026. Rapid7's Emergent Threat Response team, which nicknamed the issue KindaRails2Shell, recommends remediating affected applications urgently rather than waiting for a normal patch cycle. As of July 30 Rapid7 said it was not aware of any exploitation in the wild.
What's affected
An application is exposed if it uses the libvips image processing library for Active Storage and accepts image uploads from untrusted users. That combination is common, because Vips is the default Active Storage variant processor for applications configured with Rails 7.0 defaults or later. Rails notes that generating image variants is not a separate requirement for exposure, and Ethiack reports that only the Vips processor is affected, not Magick.
The fixed Active Storage releases are 7.2.3.2, 8.0.5.1 and 8.1.3.1, corresponding to the Rails 7.x, 8.0.x and 8.1.x branches. Ethiack also reports that Rails 6.0.0 through 6.1.7.10 may be affected where Active Storage is configured to use Vips, though Rails 6.x does not use Vips by default. Rails has not published a fixed 6.x release, so those applications need to move to a supported fixed branch or apply the workaround below.
How the attack works
libvips loads and saves image formats through a set of operations, some of which the project marks as unfuzzed or untrusted because they are unsafe to point at content an attacker controls. According to Rails, Active Storage did not disable those operations before processing user-supplied files, which may allow a crafted upload to trigger an unsafe operation and disclose files the application process can read. The patch turns untrusted operations off during Active Storage initialization, and where ruby-vips is installed the patched code prevents the application from starting if ruby-vips or libvips is too old to support that protection.
The vulnerability was independently reported by Ethiack and GMO Flatt Security. Both have withheld proof-of-concept code and details of the full attack chain. Public code claiming to exploit the flaw already exists, but Rapid7 says it is unclear how closely it corresponds to the chain reported privately to Rails. The Rails security announcement says further details will be disclosed no later than August 28, 2026.
What you should do
Updating Rails alone is not sufficient. Teams need a fixed Active Storage release and libvips 8.13 or later, plus ruby-vips 2.2.1 or later where that gem is installed. Rails also advises treating the application's secrets as compromised: replace secret_key_base along with the master key and the credentials it decrypts, storage service credentials, database credentials, and third-party service tokens. Rotating secret_key_base expires active sessions and affects encrypted and signed cookies, signed global IDs and Active Storage URLs, so plan for that disruption.
If patching has to wait, teams on libvips 8.13 or later can set VIPS_BLOCK_UNTRUSTED, or call Vips.block_untrusted(true) from an initializer with ruby-vips 2.2.1 or later. On libvips older than 8.13, Rails states the only workaround is removing the libvips dependency. The shape of the problem will be familiar to anyone who followed the recent unauthenticated flaw in JetBrains TeamCity: one unauthenticated request against developer infrastructure is often enough to reach the credentials that unlock everything downstream.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.