The critical Ruby on Rails flaw disclosed last week is worse than the advisory made it look. Rapid7 has now reproduced the attack end to end, confirmed it can be pushed all the way to running commands on the server, and released a Metasploit module that does exactly that.
Rapid7 researcher Jonah Burgess published the technical analysis on August 3, 2026. It traces CVE-2026-66066, scored 9.5 out of 10, which the Rails project patched on July 29 in Active Storage, the component that handles file uploads. IntelFusions covered the original advisory at the time, when the researchers who found the bug were still withholding proof-of-concept code and the full chain had not been published.
What's affected
The fixed Active Storage releases are 7.2.3.2, 8.0.5.1 and 8.1.3.1. Rapid7 reproduced the published chain against Rails 6.0.6.1, 6.1.7.10, 7.2.3.1, 8.0.5 and 8.1.3, and confirmed that the patched targets block the crafted request. Vips is the default Active Storage variant processor for applications that load Rails 7.0 defaults or later; Rails 6 applications are affected only where they explicitly configure Vips.
How the attack works
The chain turns on two components disagreeing about what a file is. Rails decides that an uploaded blob is an image by reading a value out of its own database. libvips, the image library underneath, decides which parser to run by reading the bytes on disk. Nothing reconciles the two.
An attacker uses the standard direct-upload endpoint, which takes the file's content type straight from the client, to register a blob that claims to be a PNG. Rails never inspects the bytes. The attacker then lifts a genuine variation key, the signed instruction that tells Rails how to resize an image, out of any image URL the same application has already published, and replays it against the new blob. Rails verifies the signed blob ID and the signed variation key independently and never checks that the two belong together.
That is enough to hand the crafted file to libvips, which recognises it as MATLAB data and parses it. Because that format can store its data outside the file itself, the bytes that come back are read from a path and an offset the attacker chose, and they are returned rendered as the pixels of an image. Rapid7 notes this particular route has narrower requirements than the advisory: the deployed libvips build has to expose the MATLAB loader with HDF5 support, the application has to preserve the attacker-supplied content type, and the attacker needs some way to trigger a representation.
From file read to code execution
The file read alone reaches anything the Rails worker process can read, and Rapid7 points at the application's own signing material as the obvious target. On Linux that means /proc/self/environ, which may hold SECRET_KEY_BASE or RAILS_MASTER_KEY, but the team is explicit that an exploit relying on that one file will miss applications keeping secrets in encrypted credentials or legacy secrets.yml paths, which the same primitive can read too. Once secret_key_base is recovered, an attacker stops replaying variation keys and signs their own.
From there Rapid7 validated a second, separate gap. Transformations handled by the Vips processor do not get the method-name validation applied on the MiniMagick path, so a signed variation built only from a hash, an array and some strings can invoke send on the image-processing builder and reach Ruby's spawn or eval. The team validated this against Rails 8.0.5 configured with the JSON message serializer. Notably, it needs no deserialization gadget at all.
Rapid7's Metasploit module walks the whole sequence: it creates the crafted direct-upload blobs, confirms the file read against /proc/version, recovers and validates the Rails signing material, signs its own variation, and then triggers either a command payload or native Ruby.
What you should do
Upgrade Active Storage to 7.2.3.2, 8.0.5.1 or 8.1.3.1. The patch does not add another content-type check. It loads a Vips initializer during boot and switches off the libvips operations that libvips itself marks unsafe for untrusted content, which is why the crafted file no longer reaches the MATLAB parser. Patched Active Storage refuses to start if the installed ruby-vips and libvips are too old to support that switch, so teams on older builds need libvips 8.13 or later and ruby-vips 2.2.1 or later before the upgrade will boot.
Any Rails application that accepts image uploads from the public internet should treat this as urgent rather than scheduled. With a Metasploit module in circulation, the skill needed to run the chain has dropped to nothing.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.