cybersecuritynews.com/critical-…
Ruby on Rails released emergency patches for CVE-2026-66066 (also called KindaRails2Shell), a critical vulnerability in Active Storage’s default libvips image-variant processing. An unauthenticated attacker who can upload images can craft a file that causes the server to read arbitrary files, including process environment variables that typically contain secret_key_base, database credentials, and cloud/API keys.
Successful file disclosure can escalate to remote code execution or lateral movement. The flaw affects applications using the default vips processor that accept untrusted image uploads. Fixed versions are Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1; libvips must also be at least 8.13. Operators are urged to patch immediately and rotate secrets.
