{"id":16554,"date":"2026-08-05T01:57:10","date_gmt":"2026-08-05T01:57:10","guid":{"rendered":"https:\/\/newestek.com\/?p=16554"},"modified":"2026-08-05T01:57:10","modified_gmt":"2026-08-05T01:57:10","slug":"ruby-on-rails-critical-bug-puts-every-image-upload-under-scrutiny","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16554","title":{"rendered":"Ruby on Rails critical bug puts every image upload under scrutiny"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

A new critical vulnerability in the Ruby on Rails (\u201cRails\u201d) web application framework, CVE-2026-66066<\/a>, could turn a seemingly innocuous image into a front door to your secrets.<\/p>\n

Disclosed July 30, the high severity CVE (scored 9.5 out of 10) poses a significant risk to enterprises running apps that handle user-uploaded images in Rails.<\/p>\n

Dubbed \u201cKindaRails2Shell,\u201d it targets the overly-trusting Active Storage component of the open-source framework, allowing unauthenticated attackers to read sensitive files or escalate to remote code execution (RCE).<\/p>\n

The issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 of Active Storage; enterprises running Rails should update immediately.<\/p>\n

\u201cThe \u2018chef\u2019s kiss\u2019 is the ability for an attacker to upload an image that isn\u2019t actually an image [but] is code that allows them to steal secrets,\u201d said David Shipley<\/a> of Beauceron Security.<\/p>\n

Attackers get the key to the castle<\/h2>\n

Ruby on Rails is an open-source, server-side application framework used for building full-stack web apps and application programming interfaces<\/a> (APIs).<\/p>\n

It is popular among developers because it is scalable, easy to learn and use, supports quick application development, taps into an active community of more than 1,000 engineers<\/a> developing and maintaining it, and has an extensive library of nearly two million lines of prebuilt code.<\/p>\n

CVE-2026-66066 specifically targets Rails\u2019 built-in Active Storage component, which lets users upload files to cloud services or local disks and link them to their applications. In particular, the vulnerability exploits the way Active Storage interacts with the libvips<\/em> image processing library<\/a> to generate images.<\/p>\n

Libvips<\/em> contains what are known as \u201cunfuzzed\u201d operations which have not been hardened against malicious inputs through techniques known as fuzzing<\/a> that test where they crash, leak data, or otherwise behave erratically. This makes them unsafe for use with untrusted content, but Active Storage does not adequately disable them.<\/p>\n

\u201cCVE-2026-66066 is particularly dangerous because an attacker may not need an account or privileged access,\u201d explained Ensar Seker<\/a>, CISO at SOCRadar.<\/p>\n

Attackers can exploit the unsafe pipeline by uploading specially crafted files that trick Active Storage into giving them access to files that the Rails process is permitted to access, even highly-sensitive ones in app processing environments.<\/p>\n

In practical terms, this could expose environment variables, Rails application secrets, database credentials, cloud access keys, API tokens and credentials for connected services, Seker explained.<\/p>\n

Attackers can also gain access to the secret_key_base<\/em> that signs and encrypts cookies, credentials<\/a>, and session data. When secret_key_base <\/em>is compromised, attackers essentially hold the key to the app.<\/p>\n

\u201cThe immediate vulnerability is an arbitrary file-read issue, but the theft of secrets such as Rails\u2019 secret_key_base<\/em> can turn information disclosure into a much broader compromise,\u201d Seker said.<\/p>\n

Depending on the application, attackers could potentially forge trusted application data or sessions, access databases and cloud services, move laterally into connected systems, or achieve RCE.<\/p>\n

That escalation path is what makes the vulnerability critical, Seker said. \u201cA seemingly routine image upload feature, such as a profile picture, avatar or thumbnail generator, could become an entry point into the application\u2019s underlying infrastructure.\u201d<\/p>\n

How to identify if you\u2019re vulnerable<\/h2>\n

Applications are impacted when they are configured to use libvips<\/em> for Active Storage image processing (the default behavior since Rails 7.0) and accept image uploads from untrusted or unauthenticated users. Enterprises should audit every internal and third-party app to determine whether they are configured this way, Seker advised, and patch Rails and Active Storage immediately. They should also examine every feature accepting images, including avatars, support attachments, product images, and administrative upload functions.<\/p>\n

Upgrading Rails alone is not sufficient when an older libvips<\/em> installation remains underneath it; libvips<\/em> must be version 8.13 or later, he said.<\/p>\n

Forensic guidance and tooling from the Rails project can help enterprises determine whether apps are vulnerable or files are exploitable, Seker noted. It\u2019s also important to review app, proxy, object-storage, and image-processing logs for suspicious uploads or unusual requests.<\/p>\n

Additionally, admins should rotate secret_key_base <\/em>and every other credential available in Rails, invalidate active sessions, and investigate downstream systems for potentially exposed credentials.<\/p>\n

\u201cSecurity teams should treat this as a potential secret-exposure incident, not merely a patch-management exercise,\u201d Seker said.<\/p>\n

Don\u2019t trust image processing pipelines<\/h2>\n

Complex image libraries support many formats and rely on numerous parsers and third-party components, creating a broad attack surface, Seker noted. Therefore, the libraries \u201cshould be treated as untrusted code execution territory.\u201d<\/p>\n

Image processing should be isolated in dedicated sandboxes, containers, or restricted to workers with minimal filesystem access, he advised. There should be no unnecessary network connectivity or access to an app\u2019s files or secrets. Strict allowlists should be applied, file content human-validated, and uploads scanned before processing and stored outside app directories.\u00a0<\/p>\n

Additional controls should include short-lived and narrowly scoped credentials, outbound network restrictions, dependency and software composition monitoring, and automated tests that confirm that dangerous codecs or operations are disabled post-upgrade, Seker said.<\/p>\n

\u201cThe broader lesson is that organizations cannot assess exposure solely by asking whether they \u2018use Rails,\u2019\u201d he noted, pointing out that two applications running the same Rails version may have very different exposure depending on their image processor, upload paths, and operating system packages. This makes visibility into runtime configuration, libraries, and app functionality critical.<\/p>\n

This incident also demonstrates the importance of secret rotation in vulnerability response, he added. \u201cWhen a vulnerability enables arbitrary file access, installing the patch closes the entry point but does not revoke credentials that may already have been copied.\u201d<\/p>\n

Don\u2019t just assume you\u2019re safe<\/h2>\n

This vulnerability illustrates a perfect use case for a software bill of materials (SBOM), which can speed up discovery of vulnerable software and triage it, Beauceron\u2019s Shipley noted. And enterprises could also adopt intelligent web application firewall monitoring and intervention in addition to isolating systems and patching.<\/p>\n

\u201cThe words you never want to hear in any critical vulnerability are \u2018arbitrary code execution\u2019 and \u2018remote code execution\u2019,\u201d he said. \u201cEither of those can mean bad news.\u201d<\/p>\n

What\u2019s also interesting here is that the disclosure process was hijacked, he pointed out. Rails published technical details about the flaw and forensic tools<\/a> to assess application vulnerability to it and to look for evidence of data exfiltration nearly a month before it planned to, because several researchers had reverse-engineered the attack and published proof of concept code.<\/p>\n

The fact that proofs of concept are now available \u201cmaterially increases the likelihood of opportunistic scanning and exploitation attempts,\u201d Seker noted.<\/p>\n

Therefore, he said, \u201ceven organizations that see no obvious evidence of compromise should not assume that patching alone removes the risk created by previously exposed secrets.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

A new critical vulnerability in the Ruby on Rails (\u201cRails\u201d) web application framework, CVE-2026-66066, could turn a seemingly innocuous image into a front door to your secrets. Disclosed July 30, the high severity CVE (scored 9.5 out of 10) poses a significant risk to enterprises running apps that handle user-uploaded images in Rails. Dubbed \u201cKindaRails2Shell,\u201d it targets the overly-trusting Active Storage component of the open-source… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16554","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16554"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16554\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}