Active exploits target critical Ruby on Rails flaw

Attackers are actively exploiting CVE-2026-66066, known as KindaRails2Shell, a critical vulnerability in Ruby on Rails that affects applications using libvips for Active Storage image processing. The bug was disclosed in late July when Rails released patches; it carries a CVSS score of 9.5. Security firm VulnCheck reported that exploitation began roughly one month after the patches and detected active attacks last week. In early August VulnCheck identified about 7,000 exposed Rails instances vulnerable to the issue.

The flaw stems from a mismatch in how different components determine a file’s type. Rails can rely on a client-provided content type to treat an upload as an image, while libvips inspects the file’s magic bytes to choose a loader. An attacker can craft a file that declares one type to Rails but contains header data that causes libvips to pick a different loader chain. Rails wrote in its advisory: “The same confusion, twice, at two layers that cannot see each other’s fields.”

In the documented attack chain, an attacker labels a payload as MATLAB Level 5 so libvips selects the MATLAB loader. That loader hands the file to libmatio, which can identify a different MAT format and pass the data to HDF5. HDF5’s External File List feature can then direct libvips to read bytes from any file path and offset on the server. The rendering process returns those bytes as image pixels, which lets an unauthenticated attacker read arbitrary files that the Rails process can access.

Files exposed by the exploit can include credential databases and storage keys. With those secrets, an attacker can forge sessions, access other systems on the network and trigger remote code execution. VulnCheck reported that while the patch blocks the libvips file-read vector, it does not fully neutralize a separate gadget tied to Ruby’s Marshal deserialization; in tests on a patched 8.1.3.1 server the RCE gadget still executed when given a valid signature.

Rails published forensic tools to help detect exploitation attempts and urged administrators to apply the patches released in late July. Administrators are advised to verify whether their Active Storage configuration relies on libvips for image processing, block uploads from untrusted users or sanitize and validate uploaded files, and review server logs for suspicious storage or image-processing requests until patches are confirmed applied. Rails and security teams continue to monitor exploitation activity and provide guidance to help teams detect and respond to incidents.

The vulnerability involves multiple components commonly used in Rails stacks: Active Storage for uploads, libvips for image processing, and downstream libraries such as libmatio and HDF5 that implement complex file formats. The interaction among those components is central to how the exploit can read arbitrary server files.