Ruby on Rails Patches Critical Vulnerability — Unauthenticated File Read and Possible RCE
The fix is out. Ruby on Rails has patched the critical KindaRails2Shell flaw (CVE-2026-66066) that let unauthenticated attackers read arbitrary files and potentially reach code execution. What Rails operators should identify, upgrade, and restart now.
The fix is shipped. Ruby on Rails has released patched versions that close KindaRails2Shell (CVE-2026-66066), the critical Active Storage flaw an unauthenticated attacker could use to read arbitrary files off a Rails server and, in the worst case, reach remote code execution. SecurityWeek reported the patch after the Rails security team disclosed the bug and cut releases the same day.
For anyone running Rails with image uploads, the takeaway is short: this is a version bump, not a config toggle you can talk yourself out of. If your app hands untrusted images to Active Storage's default libvips processor, you were in range until you upgraded.
What to Upgrade To
Rails shipped the fix across three maintained branches on July 29, 2026, per the official Rails release announcement. GitHub, acting as CVE Numbering Authority, scored the flaw 9.5 on CVSS v4 — near the top of the critical band. The fix disables libvips' untrusted operations during Active Storage initialization, so upgrading is what actually closes the hole.
| Affected Active Storage range | Fixed version |
|---|---|
| Below 7.2.3.2 | 7.2.3.2 |
| 8.0 through 8.0.5.0 | 8.0.5.1 |
| 8.1 through 8.1.3.0 | 8.1.3.1 |
The condition that puts an app in scope is narrow but common: it uses libvips for Active Storage image processing and accepts image uploads from untrusted users. Apps on the alternative Magick processor aren't hit by this vector. Teams that can't upgrade immediately can apply the documented mitigation, which blocks libvips' untrusted operations at boot and requires libvips 8.13 or newer — so check the installed libvips build as part of the same pass.
The Follow-Up to Our Earlier Disclosure
This is the patch-confirmation follow-up to our earlier coverage. When the bug first surfaced, we walked through what the advisory confirmed, the image-upload attack surface, and why a file-read flaw carries a "possible RCE" tail — see KindaRails2Shell — Critical Rails File Read and Possible RCE (CVE-2026-66066). The short version for triage: arbitrary file read is the confirmed impact; RCE is a credible escalation when the leaked file is something like secret_key_base, not a demonstrated certainty. Keep the "possible" qualifier — it's doing precise work, not hedging.
The Defender Checklist
Three moves, in order:
- Identify every Rails deployment. Don't trust memory. Check each app's
Gemfile.lockto see the Active Storage version it actually resolves to — the pinned line inGemfileisn't always what shipped. - Upgrade to the patched version for your branch (7.2.3.2, 8.0.5.1, or 8.1.3.1), taking the exact fixed release from the official Rails security advisory rather than any secondhand summary.
- Restart your application servers after upgrading. The fix runs during Active Storage initialization, so a running process keeps the old, vulnerable behavior until it's cycled.
One thing the upgrade doesn't do: un-leak a secret that already walked. If an affected app was internet-reachable, treat secret_key_base and any service credentials in the process environment as potentially exposed and rotate them.
Open Questions
Two things aren't settled. First, active exploitation: the Rails team said it wasn't aware of any exploitation attempts before or after disclosure, and as of publication there's no vendor-confirmed evidence of in-the-wild use. Treat any contrary claim cautiously until a named source stands behind it. Second, CISA KEV: we've seen no listing for CVE-2026-66066 on the Known Exploited Vulnerabilities catalog as of publication. A KEV entry would put a federal patch clock on it, so it's worth watching.
My read: patch on the assumption the window closes fast — a 9.5 with a public advisory and hundreds of thousands of default-config sites is exactly the kind of bug that gets a proof-of-concept before it gets a KEV entry.
