CVE-2026-66066

CVE-2026-66066, also known as "KindaRails2Shell," is an arbitrary file read vulnerability affecting Ruby on Rails Active Storage variant processing. This flaw stems from an insecure default in how Active Storage handles image variants through the `libvips` library. Specifically, Active Storage fails to disable certain `libvips` operations, termed "unfuzzed," which are not hardened against malicious input and are unsafe when processing untrusted content. This oversight allows an attacker to upload a specially crafted file, triggering these unsafe processing paths within `libvips`. Successful exploitation of CVE-2026-66066 can lead to the disclosure of arbitrary files accessible to the Rails application process, including sensitive data like process environment variables, `secret_key_base`, and other application secrets. The exposure of these secrets can subsequently enable further compromise, such as remote code execution or lateral movement within connected systems. An application is vulnerable if it uses `libvips` for Active Storage image processing (the default for Rails 7.0+), accepts image uploads from untrusted users, and generates variants from those uploads.