KindaRails2Shell (CVE-2026-66066): Arbitrary File Read and RCE via Active Storage Uploads

KindaRails2Shell (CVE-2026-66066): Arbitrary File Read and RCE via Active Storage Uploads 1. Basic Information Article Title : Alert on Vulnerability in Ruby on Rails Active Storage Leading to Remote Code Execution Publisher : JPCERT/CC Publication & Update Date : 2026-07-30 Original Article : https://www.jpcert.or.jp/at/2026/at260021.html Related Sources : https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm Related Entities : CVE-2026-66066, KindaRails2Shell, Ruby on Rails, Active Storage, libvips, ruby-vips Severity : Critical 2. One-Sentence Summary This is a vulnerability that combines Active Storage direct uploads and variant processing by libvips, allowing attackers to upload a crafted file without authentication, read files and credentials on the server, and potentially execute code under the Rails process permissions depending on the conditions. 3. Attack Flow The attacker discovers or guesses that the target Rails app uses Active Storage. The attacker registers a crafted file to the unauthenticated direct upload feature. The attacker triggers variant processing, which is handled by the vulnerable Active Storage and default builds of libvips. The attacker reads arbitrary files on the server. The attacker retrieves Rails secrets, cloud credentials, database credentials, and other sensitive data. The attacker may achieve remote code execution by using the retrieved secrets or the processing chain. The attacker may move laterally to databases, storage, cloud environments, or CI/CD pipelines as a next step (Inference). 4. Attacker Position and Execution Location The attacker uploads files from the external network via HTTP. The processing happens on the Rails application server and the libvips process. Remote code execution runs with the OS permissions of the Rails or variant processing service. 5. What Victims and Administrators See Even without a user-facing upload screen, apps can be vulnerable if Active Storage is enabled. Administrators m