Rails Has a New Shell Problem — Attackers Are Already Hunting KindaRails2Shell
- The Mess: Ruby on Rails is being hit by active exploitation of CVE-2026-66066, a critical Active Storage flaw that can let attackers read arbitrary files from vulnerable servers. Researchers call it KindaRails2Shell, and the stolen secrets can turn a file-read bug into remote code execution.
The bug lives in Rails applications using Active Storage with libvips for image processing while accepting image uploads from untrusted users.
That sounds like a fairly specific configuration.
It isn’t.
Active Storage is a standard Rails component for handling uploaded files, and libvips is widely used for image processing. An application that accepts profile pictures, documents, avatars or other user-uploaded images can potentially expose the vulnerable processing path.
The problem comes from a mismatch between how Rails and the underlying image-processing libraries determine what a file actually is.
An attacker can upload a specially crafted file that Rails treats as an image while libvips interprets its contents through a completely different processing path.
That confusion eventually reaches HDF5’s external-file functionality, allowing the attacker to make the server read data from a path controlled by the attacker.
And this is where a seemingly boring image-upload bug gets ugly.
- The Damage: A successful attack can expose environment variables, database credentials, cloud keys, Rails secrets and other files accessible to the application, potentially providing the ingredients for session forgery, lateral movement and remote code execution.
Rails applications tend to accumulate secrets.
Database passwords.
Cloud credentials.
API tokens.
Storage keys.
SECRET_KEY_BASE.
Once an attacker can read those files, the vulnerable image-processing endpoint is no longer the whole problem.
The attacker can use stolen application secrets against the application itself or against connected infrastructure.
Researchers have demonstrated how exposed Rails secrets can be used to forge sessions and expand access beyond the original vulnerable endpoint.
The exploitation has now moved from research into real traffic.
VulnCheck reported more than 50 detections within hours after attackers began probing the flaw. The number later climbed into the hundreds, with attackers looking for environment variables, cloud credentials, Rails secrets and SSH-related information.
The vulnerable Rails releases were patched on July 29.
Fixed versions include Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1. Applications using ImageMagick rather than libvips are not affected by this specific attack path.
- The Fix: Upgrade Rails to a patched release immediately, review every application that combines Active Storage, libvips and untrusted image uploads, and rotate credentials if a vulnerable application was exposed before patching.
Patching alone is not enough if attackers already reached the application.
Teams should review uploaded-file activity, Rails application logs and unusual requests around Active Storage processing. Secrets accessible to the Rails process should be considered potentially compromised if exploitation is suspected.
That means rotating database credentials, cloud keys, API tokens and Rails signing secrets where appropriate.
Administrators should also check connected cloud infrastructure and CI/CD systems.
A stolen Rails secret does not care that the Rails server has since been patched.
Bugstoday Opinion
This is the kind of bug that gets dismissed because the headline says “file read.”
That’s a mistake.
Attackers don’t need your /etc/passwd file.
They want the .env file sitting next to your application.
They want the cloud token.
They want the database password.
They want SECRET_KEY_BASE.
KindaRails2Shell turns a malicious image upload into a credential extraction mechanism, and the real-world exploitation proves that attackers understand the chain.
The uncomfortable lesson is simple:
File read is often just RCE wearing a different shirt.
If your Rails application accepts uploads and uses libvips, check it now.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Ruby on Rails — CVE-2026-66066 Security Advisory
CVE-2026-66066 — CVE Record
NVD — National Vulnerability Database
VulnCheck — KindaRails2Shell Exploitation Analysis
CISA — Known Exploited Vulnerabilities Catalog
