A critical vulnerability, tracked as **CVE-2026-66066**, has been discovered in **Active Storage**, a built-in component of the popular **Rails** open-source web application framework. This flaw could allow an unauthenticated attacker to read arbitrary files from a **Rails** application, potentially leading to remote code execution (RCE). **Rails** maintainers have issued an advisory for **CVE-2026-66066**, assigning it a critical severity rating. ### How the Vulnerability Works **Active Storage** handles file uploads and attachments, and can generate image thumbnails using libraries such as **libvips** or **ImageMagick**. The vulnerability is exploitable when **libvips** is in use, enabling an attacker to upload a specially crafted image to a vulnerable application. Crucially, the server must also allow image uploads from untrusted users for the attack to succeed. If these conditions are met, an attacker can read arbitrary files on the server. ### Impact of Exploitation Compromised files could include sensitive application data, such as the process environment, which often contains the `secret_key_base` (the **Rails** master key), database credentials, cloud storage credentials, and other critical secrets. Security firm **Akamai** has dubbed the attack chain "KindaRails2Shell," highlighting its significant RCE potential. **Akamai** explains: "With the `secret_key_base` compromised, the attacker holds the master cryptographic key to the application. They can forge session cookies, sign global IDs, and manipulate serialized data, which directly translates into full RCE on the underlying server." ### Affected Versions and Remediation **CVE-2026-66066** affects **Active Storage** before versions 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. **Rails** 6.x is only vulnerable if **Active Storage** has been configured outside its default settings. Developers are strongly advised to upgrade to **libvips 8.13** or later. Additionally, it is critical to rotate the `secret_key_base`, database credentials, **Active Storage** service credentials, and any other secrets accessible to the application process. For systems running **libvips 8.13** or newer, administrators can temporarily disable the vulnerable functionality by setting the `VIPS_BLOCK_UNTRUSTED` environment variable or by calling `Vips.block_untrusted(true)` when using `ruby-vips 2.2.1` or newer. No workaround is available for applications using **libvips** before version 8.13. Users of **ImageMagick** are not affected by this specific vector. However, **libvips** is the default processor in official **Rails Docker** images, as well as **Debian** and **Ubuntu** setups. ### Disclosure and Forensic Tools The **Rails** team initially withheld full technical details to mitigate immediate exploitation risks. However, due to the rapid emergence of public proof-of-concept (PoC) exploits, they accelerated the release of full details and provided forensic investigation tooling. The vulnerability was responsibly reported by researchers from **Ethiack** and **GMO Flatt Security Inc.** While Web Application Firewalls (WAFs) might offer a temporary buffer, **Ethiack** notes that attackers leveraging AI tools could potentially reconstruct the attack chain based on patch diffs. **Akamai** has already deployed WAF protections for its customers in coordination with **Ethiack** prior to public disclosure.