CVE-2026-66066

CVE-2026-66066 is a flaw in Active Storage (part of Ruby on Rails' Action Pack) in which libvips operations that are marked unsafe for untrusted content are not disabled, so a crafted upload can invoke such an operation on the server. It is triggered when an unauthenticated attacker uploads a maliciously crafted image to a Rails application that is configured to use libvips and accepts image uploads from untrusted users. Successful exploitation lets the attacker read arbitrary files accessible to the Rails process, including environment variables and application secrets; leaked credentials such as secret_key_base or external-service tokens can be leveraged for remote code execution or lateral movement. Affected applications are those running Rails 7.2.x, 8.0.x or 8.1.x before the patched releases 7.2.3.2, 8.0.5.1 and 8.1.3.1, provided Active Storage with libvips is in use. Public exploit code is not yet documented, but news reports describe active attacks against Rails apps (a campaign referred to as "KindaRails2Shell"), EPSS assigns a 27.9% probability of exploitation within 30 days (98th percentile), and the flaw is not yet listed in CISA KEV.

What to do: Upgrade Rails to 7.2.3.2, 8.0.5.1 or 8.1.3.1 depending on your release series. If patching is delayed, restrict or disable libvips processing of untrusted uploads (e.g., limit image variant/preview generation) and review upload and application logs for suspicious image submissions. Treat secrets as potentially compromised on any exposed app: rotate secret_key_base and API/service tokens, and check for signs of follow-on compromise such as forged sessions or unexpected outbound connections.