Ruby on Rails Active Storage arbitrary file read via libvips

CVE-2026-66066 is a critical flaw (CVSSv4 9.5, CWE-1188) in Ruby on Rails’ Active Storage component when used with the libvips image processing library. The Rails project published a security advisory on July 29, 2026.

An unauthenticated attacker can send crafted image processing requests that cause the Rails application process to read files outside the intended upload path and return their contents. Typical targets: config/master.key, config/credentials.yml.enc, .env, and anything else readable by the process user — database passwords, session secrets, cloud service credentials.

Rapid7 named this “KindaRails2Shell” in their ETR, noting that arbitrary file read at the Rails process level is a common starting point for privilege escalation: stolen credentials enable session forgery, database access, and lateral movement into cloud environments.

Who is affected: Rails applications using Active Storage with libvips for image transformations. Applications that use ImageMagick instead of libvips, or that do not use Active Storage image processing, are not affected by this specific vector.

Fix: Upgrade to the patched Rails release. The Rails security page lists affected and fixed version ranges. If immediate upgrade isn’t possible: disable libvips-based image transformations, tighten file-system permissions on the Rails process user, and rotate any secrets readable by that process — treat them as compromised until confirmed otherwise.

Priority: Patch first, then rotate secrets. The gap between public disclosure and active exploitation for critical web-framework CVEs is typically short.

See also: Rails Patches Critical File Read via Image Upload