--- title: Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066) description: Rapid7 provides a deep technical analysis of CVE-2026-66066 (KindaRails2Shell), a critical vulnerability in Ruby on Rails Active Storage affecting applications... canonical: https://daily.dev/posts/rapid7-analysis-kindarails2shell-cve-2026-66066--plnathbhp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066) | daily.dev og:description: Rapid7 provides a deep technical analysis of CVE-2026-66066 (KindaRails2Shell), a critical vulnerability in Ruby on Rails Active Storage affecting applications... og:url: https://daily.dev/posts/rapid7-analysis-kindarails2shell-cve-2026-66066--plnathbhp og:image: https://api.daily.dev/og/posts/pLNATHBhP.png og:image:alt: Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066) **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 16 min read · 0 upvotes · 0 comments ## Summary Rapid7 provides a deep technical analysis of CVE-2026-66066 (KindaRails2Shell), a critical vulnerability in Ruby on Rails Active Storage affecting applications using the Vips image processor. The flaw stems from two trust failures: Rails trusts the attacker-supplied content_type stored in the database without examining file bytes, while libvips and libmatio disagree on MAT header interpretation. A crafted MAT/HDF5 file claiming to be image/png can be uploaded via the direct-upload endpoint, then triggered via a replayed genuine variation_key to reach libvips's matload, which passes the file to libmatio's HDF5 reader. HDF5 external storage allows the attacker to read arbitrary files from the server as image pixels. The arbitrary file read can expose SECRET_KEY_BASE from /proc/self/environ, enabling an attacker to forge signed ImageProcessing variations containing send/spawn or send/eval payloads for full RCE. The patch fixes the issue by calling Vips.block_untrusted(true) during Rails initialization, blocking all libvips operations marked VIPS_OPERATION_UNTRUSTED. A Metasploit module implementing the full chain is referenced. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments - [Ruby, Rails & AI Daily — September 10, 2026" description: "A critical Active Storage RCE is now under active exploitation, ZJIT learns to inline GC allocations, and Google, Anthropic, and OpenAI all s](https://daily.dev/posts/ruby-rails-ai-daily-september-10-2026-description-a-critical-active-storage-rce-is-now-unde-xetkjqgtn) · Ruby Flow · 2 upvotes · 0 comments - [CVE-2026-33658 \(activestorage\): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests](https://daily.dev/posts/cve-2026-33658-activestorage-rails-active-storage-has-a-possible-dos-vulnerability-in-proxy-mode--d7ncwb9vs) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/rapid7-analysis-kindarails2shell-cve-2026-66066--plnathbhp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)","url":"https://daily.dev/posts/rapid7-analysis-kindarails2shell-cve-2026-66066--plnathbhp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rapid7-analysis-kindarails2shell-cve-2026-66066--plnathbhp"},"datePublished":"2026-08-03T17:48:19.250Z","dateModified":"2026-08-24T06:56:54.558Z","description":"Rapid7 provides a deep technical analysis of CVE-2026-66066 (KindaRails2Shell), a critical vulnerability in Ruby on Rails Active Storage affecting applications...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rapid7-analysis-kindarails2shell-cve-2026-66066--plnathbhp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,rails","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)"}]} ```