CVE-2026-66066: an image upload path that reads /proc/self/environ

CVE-2026-66066 is an image upload path vulnerability in Ruby on Rails applications that use Active Storage with libvips as the variant processor. This flaw, dubbed KindaRails2Shell, has a score of 9.5. The issue stems from libvips, which can parse scientific and data formats like HDF5 and MATLAB, and does not restrict this ability for untrusted uploads.

For a deployment to be exploitable, Active Storage must be enabled, the variant processor set to vips, an upload route open to untrusted users, and libvips version must be below 8.13. To exploit, an attacker uploads a disguised file containing an HDF5 structure with an external file reference. Upon generating a variant, libvips resolves the reference and reads the referenced file, exposing the process environment and SECRET_KEY_BASE.

With this, an attacker can forge signed variant parameters and execute commands with the Rails process's privileges. The vulnerability is classified under CWE-1188, addressing insecure default initialization of a resource. Automated tools quickly responded with a Metasploit module, but upgrading and setting Vips.block_untrusted = true are the main safeguards.

Remediation also involves rotating the SECRET_KEY_BASE and any other secrets readable from the process environment. Operators can verify exposure by checking framework and component versions, confirming the variant processor, and examining the routing table for a direct uploads route.