--- title: KindaRails2Shell: CVE-2026-66066, Critical Arbitrary... description: A critical vulnerability (CVE-2026-66066, CVSSv4 9.5) has been disclosed in Ruby on Rails affecting Active Storage image processing when using the libvips... canonical: https://daily.dev/posts/kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-pt033wb2b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails | daily.dev og:description: A critical vulnerability (CVE-2026-66066, CVSSv4 9.5) has been disclosed in Ruby on Rails affecting Active Storage image processing when using the libvips... og:url: https://daily.dev/posts/kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-pt033wb2b og:image: https://api.daily.dev/og/posts/pt033WB2B.png og:image:alt: KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 4 min read · 0 upvotes · 0 comments ## Summary A critical vulnerability (CVE-2026-66066, CVSSv4 9.5) has been disclosed in Ruby on Rails affecting Active Storage image processing when using the libvips library. An unauthenticated attacker can craft a malicious image upload to trigger unsafe libvips operations, potentially reading arbitrary files accessible to the Rails process — including secrets that could enable remote code execution. Applications using Rails 7.0+ defaults are affected by default since Vips is the default variant processor. Patched releases are 7.2.3.2, 8.0.5.1, and 8.1.3.1, and libvips must be updated to 8.13 or later. Updating Rails alone is insufficient if libvips is outdated. Organizations are also advised to rotate all secrets accessible to the application process. Workarounds include setting VIPS_BLOCK_UNTRUSTED or calling Vips.block_untrusted(true). No confirmed exploitation in the wild as of July 30, 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments - [Ruby, Rails & AI Daily — September 10, 2026" description: "A critical Active Storage RCE is now under active exploitation, ZJIT learns to inline GC allocations, and Google, Anthropic, and OpenAI all s](https://daily.dev/posts/ruby-rails-ai-daily-september-10-2026-description-a-critical-active-storage-rce-is-now-unde-xetkjqgtn) · Ruby Flow · 2 upvotes · 0 comments - [CVE-2026-33658 \(activestorage\): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests](https://daily.dev/posts/cve-2026-33658-activestorage-rails-active-storage-has-a-possible-dos-vulnerability-in-proxy-mode--d7ncwb9vs) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-pt033wb2b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails","url":"https://daily.dev/posts/kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-pt033wb2b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-pt033wb2b"},"datePublished":"2026-07-30T16:17:59.943Z","dateModified":"2026-08-05T02:00:50.931Z","description":"A critical vulnerability (CVE-2026-66066, CVSSv4 9.5) has been disclosed in Ruby on Rails affecting Active Storage image processing when using the libvips...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-pt033wb2b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,rails","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails"}]} ```