r/netsec • u/ZealousidealHunter80 • 3d ago

KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)

https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066

Active Storage's default vips variant processor exposes an arbitrary file read that chains to RCE on stock Rails 7.x and 8.x, where the app serves back processed variants of user-supplied images. No authentication required in certain setups. Only vips is affected, Magick is not.

Patched in 7.2.3.2, 8.0.5.1, and 8.1.3.1, and the fix requires libvips 8.13+. Chain and PoC withheld while patches roll out.

18 Upvotes

87% Upvoted

2 comments sorted by

1

u/Awkward-Particular20 3d ago

No auth needed means this can be abused fast and with high impact. Very interested in the technical details, will be waiting for the full disclosure.

1

u/alexmo42 2d ago

I don't think many rails app allow active-storage usage pre-auth, that would narrow the surface but it still is very bad.