--- title: CVE-2026-66066: Critical Active Storage vulnerability... description: Rails has patched a critical vulnerability (CVE-2026-66066) in Active Storage across versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. The flaw affects apps using... canonical: https://daily.dev/posts/cve-2026-66066-critical-active-storage-vulnerability-patched-in-rails-7-2-3-2-8-0-5-1-and-8-1-3-1-cc4asdkde twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-66066: Critical Active Storage vulnerability patched in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 | daily.dev og:description: Rails has patched a critical vulnerability (CVE-2026-66066) in Active Storage across versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. The flaw affects apps using... og:url: https://daily.dev/posts/cve-2026-66066-critical-active-storage-vulnerability-patched-in-rails-7-2-3-2-8-0-5-1-and-8-1-3-1-cc4asdkde og:image: https://api.daily.dev/og/posts/cC4ASDKde.png og:image:alt: CVE-2026-66066: Critical Active Storage vulnerability patched in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-66066: Critical Active Storage vulnerability patched in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 **[Collections](https://daily.dev/sources/collections)** · 4 min read · 1 upvotes · 0 comments ## Summary Rails has patched a critical vulnerability (CVE-2026-66066) in Active Storage across versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. The flaw affects apps using libvips for image processing that accept untrusted file uploads. An unauthenticated attacker can exploit it to read arbitrary server files — including secret_key_base and credentials — and potentially achieve remote code execution. Immediate upgrade is recommended. Three workarounds are available if upgrading isn't immediately possible: setting VIPS_BLOCK_UNTRUSTED=1, calling Vips.block_untrusted(true) in an initializer, or removing the ruby-vips gem to fall back to ImageMagick. ## Content ## What happened Rails released security patches on July 30, 2026 — versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 — addressing a critical vulnerability in Active Storage tracked as CVE-2026-66066, nicknamed KindaRails2Shell. It carries a CVSSv4 score of 9.5. No confirmed exploitation in the wild was reported at disclosure time, but public proof-of-concept code appeared quickly afterward, which pushed the Rails team to release full technical details and forensic tooling earlier than originally planned. ## What the vulnerability actually does The flaw lives in how Active Storage processes image variants when libvips is the image processor — which has been the default since Rails 7.0, so most modern Rails apps are affected by default. The attack chain works like this: 1. An unauthenticated attacker uploads a crafted MAT/HDF5 file to the direct-upload endpoint while claiming a content type of `image/png`. 2. Rails trusts the attacker-supplied `content_type` stored in the database without inspecting the actual file bytes. 3. The attacker replays a genuine `variation_key` to trigger image processing, which routes the file to libvips's `matload`. 4. `matload` passes the file to libmatio's HDF5 reader. HDF5's external storage feature lets the attacker specify arbitrary file paths on the server, which get read back as image pixel data. 5. That arbitrary file read can expose `/proc/self/environ`, leaking `SECRET_KEY_BASE`. 6. With `SECRET_KEY_BASE` in hand, an attacker can forge signed ImageProcessing variations containing `send/spawn` or `send/eval` payloads, escalating to full remote code execution. The two root causes are distinct: Rails trusts attacker-supplied content type metadata, and libvips and libmatio disagree on how to interpret MAT file headers. A Metasploit module implementing the full chain has been published. ## Patching is a two-step process This is where a lot of teams have gotten tripped up: **updating the Rails gem alone is not enough.** The fix requires: - Rails updated to 7.2.3.2, 8.0.5.1, or 8.1.3.1 - libvips updated to 8.13 or newer libvips is a system library, not a gem. It comes from your container base image. If you're on Debian bullseye, `apt` only provides libvips 8.10.x — rebuilding on that base still leaves you vulnerable. The patched gem will actively refuse to boot when it detects an old libvips version, raising a `RuntimeError`, so at least you'll know. Apps that were never updated at all remain silently exploitable with no visible errors. The recommended path is moving to Debian bookworm, which ships libvips 8.14. The patch itself works by calling `Vips.block_untrusted(true)` during Rails initialization, which blocks all libvips operations flagged as `VIPS_OPERATION_UNTRUSTED`. ## Workarounds if you can't patch immediately If upgrading right now isn't possible, you have a few options: - Call `Vips.block_untrusted(true)` from an initializer (requires ruby-vips >= 2.2.1 and libvips >= 8.13) - Set the `VIPS_BLOCK_UNTRUSTED=1` environment variable (also requires libvips >= 8.13) - Remove the `ruby-vips` gem entirely to disable Vips processing - Apply WAF rules targeting the direct-upload endpoint Note that the first two workarounds still require libvips 8.13+, so they don't help if your system library is too old. ## After patching: rotate your secrets Patching stops future exploitation, but if your app was exposed before patching, any secrets that were readable via `/proc/self/environ` or other accessible files should be considered compromised. That means rotating `SECRET_KEY_BASE`, database credentials, API tokens, and anything else the Rails process could read. Rotating `SECRET_KEY_BASE` also invalidates all existing sessions, which is worth communicating to users. The Rails team also released forensic tooling to scan for malicious uploads — worth running if you have any reason to suspect prior exploitation. ## Other changes in these releases Beyond the security fix, the same release cycle brought a few notable improvements: - **i18n loading speed**: initialization time dropped from ~400ms to ~250ms - **Thread-safe lazy route loading**: implemented using a three-state flag with a reentrant Monitor - **Ractor-safe controller middleware**: uses copy-on-write to avoid shared mutable state - **Template resolution**: optimized to a single pass instead of multiple - **SQL logging**: now shows positional parameter markers instead of raw bind arrays - **Deprecations**: `TransactionState` predicates and certain `insert`/`to_sql` arguments are deprecated If you're on an older unsupported Rails version, now is a good time to upgrade to at least the 7.2 series. ## SHA-256 verification SHA-256 hashes for all gem packages are available in the official release announcement for verification before deploying. ## Questions this post answers ### What is CVE-2026-66066 in Rails Active Storage and how does the exploit chain work? It is a critical (CVSSv4 9.5) remote code execution vulnerability nicknamed KindaRails2Shell affecting Active Storage when libvips is the image processor, the default since Rails 7.0. An attacker uploads a crafted MAT/HDF5 file labeled as image/png, Rails trusts the unverified content type, and libvips's matload passes it to libmatio's HDF5 reader, whose external storage feature allows arbitrary file reads, exposing SECRET_KEY_BASE and enabling forged variations that execute code. A Metasploit module already implements the full chain. _daily.dev helps developers keep up with fast-moving Rails CVEs like this before they hit production._ ### How do I fully patch Rails against CVE-2026-66066, and is updating the gem enough? No, updating the Rails gem alone is not enough. Applications also need libvips upgraded to 8.13 or newer, since libvips is a system library shipped by the container base image rather than a gem; Debian bullseye only provides 8.10.x, so switching to Debian bookworm (which ships 8.14) is recommended. Patch to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1, and the gem will refuse to boot if it detects an outdated libvips. _Teams tracking multi-layered patches like this rely on daily.dev to catch details easy to miss during upgrades._ ### What should I do if my Rails app was exposed to CVE-2026-66066 before patching? Rotate SECRET_KEY_BASE, database credentials, API tokens, and any other secrets the Rails process could read, since files accessible via /proc/self/environ should be considered compromised once exposed. Rotating SECRET_KEY_BASE also invalidates all existing user sessions, so communicate that to users. Rails also released forensic tooling to scan for malicious uploads if prior exploitation is suspected. _daily.dev keeps security-conscious Rails teams informed on incident response steps like secret rotation after a breach._ --- Tags: [#security](https://daily.dev/tags/security), [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/cve-2026-66066-critical-active-storage-vulnerability-patched-in-rails-7-2-3-2-8-0-5-1-and-8-1-3-1-cc4asdkde) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-66066: Critical Active Storage vulnerability patched in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1","url":"https://daily.dev/posts/cve-2026-66066-critical-active-storage-vulnerability-patched-in-rails-7-2-3-2-8-0-5-1-and-8-1-3-1-cc4asdkde","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-66066-critical-active-storage-vulnerability-patched-in-rails-7-2-3-2-8-0-5-1-and-8-1-3-1-cc4asdkde"},"datePublished":"2026-07-30T00:35:57.262Z","dateModified":"2026-09-13T19:41:22.963Z","description":"Rails has patched a critical vulnerability (CVE-2026-66066) in Active Storage across versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. The flaw affects apps using...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-66066-critical-active-storage-vulnerability-patched-in-rails-7-2-3-2-8-0-5-1-and-8-1-3-1-cc4asdkde","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,rails","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"CVE-2026-66066: Critical Active Storage vulnerability patched in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-2026-66066-critical-active-storage-vulnerability-patched-in-rails-7-2-3-2-8-0-5-1-and-8-1-3-1-cc4asdkde#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-66066 in Rails Active Storage and how does the exploit chain work?","acceptedAnswer":{"@type":"Answer","text":"It is a critical (CVSSv4 9.5) remote code execution vulnerability nicknamed KindaRails2Shell affecting Active Storage when libvips is the image processor, the default since Rails 7.0. An attacker uploads a crafted MAT/HDF5 file labeled as image/png, Rails trusts the unverified content type, and libvips's matload passes it to libmatio's HDF5 reader, whose external storage feature allows arbitrary file reads, exposing SECRET_KEY_BASE and enabling forged variations that execute code. A Metasploit module already implements the full chain. daily.dev helps developers keep up with fast-moving Rails CVEs like this before they hit production."}},{"@type":"Question","name":"How do I fully patch Rails against CVE-2026-66066, and is updating the gem enough?","acceptedAnswer":{"@type":"Answer","text":"No, updating the Rails gem alone is not enough. Applications also need libvips upgraded to 8.13 or newer, since libvips is a system library shipped by the container base image rather than a gem; Debian bullseye only provides 8.10.x, so switching to Debian bookworm (which ships 8.14) is recommended. Patch to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1, and the gem will refuse to boot if it detects an outdated libvips. Teams tracking multi-layered patches like this rely on daily.dev to catch details easy to miss during upgrades."}},{"@type":"Question","name":"What should I do if my Rails app was exposed to CVE-2026-66066 before patching?","acceptedAnswer":{"@type":"Answer","text":"Rotate SECRET_KEY_BASE, database credentials, API tokens, and any other secrets the Rails process could read, since files accessible via /proc/self/environ should be considered compromised once exposed. Rotating SECRET_KEY_BASE also invalidates all existing user sessions, so communicate that to users. Rails also released forensic tooling to scan for malicious uploads if prior exploitation is suspected. daily.dev keeps security-conscious Rails teams informed on incident response steps like secret rotation after a breach."}}]} ```