A vital vulnerability within the Lively Storage framework can enable an unauthenticated attacker to learn arbitrary information from a Rails utility, and doubtlessly escalate to distant code execution (RCE).
Rails is a well-liked open-source net utility framework written in Ruby for constructing web sites and net apps. It makes use of the built-in Rails element Lively Storage for dealing with file uploads and attachments.
Rails maintainers revealed an advisory concerning the CVE-2026-66066 flaw, which acquired a vital severity ranking.
Lively Storage may additionally generate picture thumbnails from uploaded media utilizing picture processing libraries corresponding to libvips or ImageMagick.
Based on the safety bulletin, CVE-2026-66066 is exploitable when libvips is used, permitting an attacker to add a specifically crafted picture to a susceptible utility and skim arbitrary information on the server.
One other prerequisite for the assault is that the server wants to permit picture uploads from untrusted customers.
If these necessities are met, an attacker could entry app information, together with the method surroundings, which generally comprises ‘secret_key_base’ and credentials for databases, cloud storage, and different providers.
CVE-2026-66066 impacts Lively Storage earlier than 7.2.3.2, 8.0.x earlier than 8.0.5.1, and eight.1.x earlier than 8.1.3.1.
Rails 6.x is just affected if Lively Storage has been configured exterior its defaults.
The Rails group recommends upgrading to libvips 8.13 or later and rotating the ‘secret_key_base’ (the Rails grasp key), database credentials, Lively Storage service credentials, and some other secrets and techniques accessible to the applying course of.
For methods working libvips 8.13 or later, directors can quickly disable the susceptible performance by setting the VIPS_BLOCK_UNTRUSTED surroundings variable or calling Vips.block_untrusted(true) when utilizing ruby-vips 2.2.1 or newer.
There isn’t any workaround accessible for apps that use libvips earlier than 8.13.
ImageMagick customers aren’t affected by this vector. Nevertheless, libvips is the default processor within the official Rails Docker photographs, and in addition Debian and Ubuntu setups.
The Rails group stated it has deliberately withheld technical particulars for the vulnerability to scale back the chance of exploitation earlier than customers have time to use the updates.
Full technical particulars had been initially scheduled to be disclosed on August 28 on the Rails boards.
Nevertheless, as a result of public proof-of-concept (PoC) exploits turned accessible in a short time, the maintainers determined to publish the complete particulars in addition to forensic investigation tooling.
The vulnerability was found and responsibly reported to the Rails group by researchers from Ethiack and GMO Flatt Safety Inc.
Safety agency Akamai has additionally revealed a warning about CVE-2026-66066, naming the assault chain “KindaRails2Shell,” and warning about its RCE potential.
“With the secret_key_base compromised, the attacker holds the grasp cryptographic key to the applying,” explains Akamai.
“They will forge session cookies, signal international IDs, and manipulate serialized knowledge, which instantly interprets into full RCE on the underlying server.”
Akamai says it coordinated with Ethiack earlier than public disclosure to organize protections for purchasers, and has now launched net utility firewall (WAF) protections.
Ethiack famous {that a} WAF would possibly purchase admins a while, however attackers utilizing AI tooling ought to have the ability to reconstruct the assault chain based mostly on the patch diffs.
Safety groups log 54% of profitable assaults and alert on simply 14%. The remaining transfer by means of your surroundings unseen.
The Picus whitepaper reveals how breach and assault simulation exams your SIEM and EDR guidelines so threats cease slipping by detection.
