Attackers are exploiting CVE-2026-66066, a critical Ruby on Rails flaw nicknamed KindaRails2Shell that turns image uploads into an arbitrary file read, roughly a month after patches shipped.
The bug, rated CVSS 9.5, exposes secrets and can chain into remote code execution and lateral movement. Applications in scope run libvips for Active Storage image processing and take image uploads from untrusted users. Rails rolled out fixes in late July, and researchers soon published technical write-ups and proof-of-concept code, with the project issuing forensic tools to detect exploitation attempts.
Rails traced the root cause to conflicting file interpretation: Rails trusts the client-supplied content type while libvips trusts magic bytes. A file labeled MATLAB Level 5 is enough: libvips hands it to libmatio, which passes it along to HDF5. The External File List option in HDF5 allows a dataset to reference bytes living in another file, located by path and offset; rendering the “image” then returns an attacker-chosen file’s contents as pixels.
Anything the Rails process can read is then within reach of an unauthenticated attacker: credential databases, storage keys, and whatever those enable, from session forgery to code execution across connected systems. VulnCheck says exploitation began last week and that tests on a patched server show the fix blocks the libvips file read but does not neutralize a variation-key Marshal deserialization RCE gadget given a valid signature. In early August, VulnCheck counted roughly 7,000 exposed Rails instances vulnerable to the flaw.
