Critical Ruby on Rails Active Storage RCE Vulnerability Gets Public PoC

Key Takeaways

• A critical remote code execution (RCE) vulnerability, identified as CVE-2026-66066 (KindaRails2Shell), impacts Ruby on Rails Active Storage.
• The flaw affects deployments using the libvips image-processing library and accepting untrusted user uploads.
• Successful exploitation could lead to arbitrary file disclosure, potentially exposing sensitive data like AWS credentials, database passwords, and application secrets.
• Chaining file disclosure with other vulnerabilities could enable full RCE, allowing attackers to compromise the server and associated cloud resources.
• Patches are available for Rails versions 7.2.3.2, 8.0.5.1, and 8.1.3.1.

Critical Ruby on Rails Active Storage RCE Vulnerability Revealed, Public PoC Released

A significant security flaw within Ruby on Rails Active Storage has surfaced, raising alarms for organizations, particularly those leveraging Amazon Web Services (AWS) to host customer platforms. This vulnerability, tracked as CVE-2026-66066 and dubbed “KindaRails2Shell,” presents a critical risk of remote code execution (RCE).

The flaw specifically targets Active Storage configurations that integrate the libvips image-processing library and are configured to accept file uploads from untrusted sources. While no widespread breaches have been confirmed to date, the potential for attackers to compromise cloud credentials and sensitive customer data is substantial.

Technical Details of the Vulnerability

The root cause of the vulnerability lies within Rails Active Storage’s image variant processing. The system failed to adequately restrict certain libvips operations that are inherently unsafe when handling content from untrusted origins. This oversight permits an unauthenticated attacker to submit a specially crafted file upload, which can then be processed by libvips to read arbitrary files accessible to the Rails application process.

The implications of such file disclosure are severe. Attackers could potentially access critical system files, including environment variables, configuration settings, database credentials, API tokens, and, most critically, AWS access keys. For organizations operating within AWS, compromised cloud credentials could grant unauthorized access to a wide array of services, such as S3 buckets, databases, backups, and application logs, depending on the permissions associated with the compromised identity.

Should a company store sensitive user records, identity information, contact details, or proprietary internal files within its AWS environment, an incident stemming from this vulnerability could lead to a catastrophic data breach impacting potentially hundreds of thousands of users.

Path to Remote Code Execution

Security researchers have warned that the threat extends beyond mere file disclosure. Rails applications frequently store the secret_key_base in environment variables. If an attacker successfully exfiltrates this secret, they could then forge Rails-signed data. This capability could be chained with other attack vectors to achieve full remote code execution on the server.

Successful RCE would allow an attacker to execute arbitrary commands with the privileges of the Rails process. This could facilitate further data theft, manipulation of application behavior, or extensive exploitation of cloud services connected to the compromised environment.

Affected Versions and Public PoC

The vulnerability impacts Rails versions prior to Active Storage 7.2.3.2, 8.0.5.1, and 8.1.3.1. Additionally, Rails 6 applications are at risk if they have been manually configured to utilize the Vips processor for Active Storage. A proposed Metasploit module on GitHub illustrates how attackers can combine file access with forged image data to achieve command execution, demonstrating a clear path to RCE.

This module has reportedly been validated in controlled environments against Rails versions 6.0.6.1, 6.1.7.10, and 8.0.5. The public availability of such exploit development underscores the critical need for organizations to identify and patch any exposed Rails services immediately.

What You Should Do

• Patch Immediately: Apply the latest security updates for Ruby on Rails. Ensure your Active Storage is updated to versions 7.2.3.2, 8.0.5.1, 8.1.3.1, or newer.
• Review Upload Endpoints: Audit all Active Storage upload endpoints to determine if they accept untrusted image uploads and if they utilize the libvips processor.
• Rotate Credentials: If exposure is suspected, immediately rotate all Rails secrets (e.g., secret_key_base) and AWS access credentials.
• Audit Logs: Scrutinize AWS CloudTrail, S3 access logs, and application logs for any unusual or unauthorized access patterns.
• Enforce Least Privilege: Implement strict least-privilege IAM roles for all AWS resources.
• Secure Secrets: Avoid storing long-lived cloud secrets directly in process environment variables. Utilize secure secret management solutions where possible.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.