Rapid7 provides a deep technical analysis of CVE-2026-66066 (KindaRails2Shell), a critical vulnerability in Ruby on Rails Active Storage affecting applications using the Vips image processor. The flaw stems from two trust failures: Rails trusts the attacker-supplied content_type stored in the database without examining file bytes, while libvips and libmatio disagree on MAT header interpretation. A crafted MAT/HDF5 file claiming to be image/png can be uploaded via the direct-upload endpoint, then triggered via a replayed genuine variation_key to reach libvips's matload, which passes the file to libmatio's HDF5 reader. HDF5 external storage allows the attacker to read arbitrary files from the server as image pixels. The arbitrary file read can expose SECRET_KEY_BASE from /proc/self/environ, enabling an attacker to forge signed ImageProcessing variations containing send/spawn or send/eval payloads for full RCE. The patch fixes the issue by calling Vips.block_untrusted(true) during Rails initialization, blocking all libvips operations marked VIPS_OPERATION_UNTRUSTED. A Metasploit module implementing the full chain is referenced.
