A 9.5-severity Rails bug turns image uploads into remote code execution

A 9.5-severity, unauthenticated flaw in Ruby on Rails' Active Storage component lets any visitor to a vulnerable app read sensitive files and run code on the server, all through a single crafted image upload. The bug, tracked as CVE-2026-66066, was disclosed on July 30.

The attack works because Active Storage hands uploaded images to the libvips image-processing library, which contains operations that have not been hardened against malicious input. Active Storage does not adequately disable those unsafe operations for untrusted uploads, so a payload disguised as a normal image can read whatever the Rails process can read.

Rails maintainers have shipped patches in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Teams running any of the affected branches should update in the current patch window.

"You can upload code as an image and the server runs it," said David Shipley of Beauceron Security, which coined the nickname "KindaRails2Shell" for the flaw. The unauthenticated, no-account characteristic makes exposure easier to size than most Rails bugs of this severity, added Ensar Seker, CISO at SOCRadar.

Apps that do not use Active Storage, or that front uploads with a different storage backend, are not affected by this CVE. There is no public evidence of in-the-wild exploitation yet; the fix is out before that window opens.