Ruby on Rails: Ethiack Helps Remediate Critical Vulnerability That Exposed More Than 500,000 Websites

Critical Ruby on Rails Vulnerability Exposes Web Applications to Remote Code Execution

Cybersecurity firm Ethiack has uncovered a severe remote code execution (RCE) vulnerability, dubbed KindaRails2Shell, in Ruby on Rails, a widely used open-source web framework powering an estimated 500,000 applications, including high-profile platforms and enterprise services.

The flaw, tracked as CVE-2026-66066 with a CVSS score of 9.5, resides in the framework’s default image processing component and affects Ruby on Rails versions 7.x and 8.x. Attackers can exploit the vulnerability when users upload images such as profile photos or thumbnails to read sensitive files, execute malicious code, or gain full server control.

Discovered by Ethiack researchers André Baptista, Bruno Mendes, and Rafael Castilho, the issue was responsibly disclosed to the Ruby on Rails maintainers. Ethiack later collaborated with Tokyo-based GMO Flatt Security, which independently identified the same flaw, to support a coordinated global remediation effort. Patches have since been released, but Ethiack warns that updating the framework alone may not suffice organizations may also need to update a third-party image processing library, requiring a multi-stage remediation process.

While technical details are now public, the vulnerability’s severity underscores the risks of unpatched systems, particularly in environments handling user-uploaded content. Ethiack has published a detailed remediation guide alongside the official advisory.

Source: https://www.cybersecurity-insiders.com/ethiack-helps-remediate-critical-vulnerability-that-exposed-more-than-500000-websites/

Ruby on Rails TPRM report: https://www.rankiteo.com/company/ruby-on-rails-org

"id": "rub1785673407",
"linkid": "ruby-on-rails-org",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'location': 'Global',
                        'size': 'Estimated 500,000 applications',
                        'type': 'Web applications'}],
 'attack_vector': 'User-uploaded image processing',
 'data_breach': {'sensitivity_of_data': 'High (potential for full server '
                                        'control)',
                 'type_of_data_compromised': 'Sensitive files'},
 'description': 'Cybersecurity firm Ethiack has uncovered a severe remote code '
                'execution (RCE) vulnerability, dubbed KindaRails2Shell, in '
                'Ruby on Rails, a widely used open-source web framework '
                'powering an estimated 500,000 applications. The flaw allows '
                'attackers to read sensitive files, execute malicious code, or '
                'gain full server control when users upload images such as '
                'profile photos or thumbnails.',
 'impact': {'data_compromised': 'Sensitive files',
            'operational_impact': 'Potential full server control',
            'systems_affected': 'Ruby on Rails applications (versions 7.x and '
                                '8.x)'},
 'investigation_status': 'Vulnerability disclosed and patched',
 'post_incident_analysis': {'corrective_actions': 'Patches released; '
                                                  'multi-stage remediation '
                                                  'process required',
                            'root_causes': "Vulnerability in Ruby on Rails' "
                                           'default image processing '
                                           'component'},
 'recommendations': 'Update Ruby on Rails framework and third-party image '
                    'processing library; follow multi-stage remediation '
                    "process outlined in Ethiack's guide.",
 'references': [{'source': 'Ethiack'}, {'source': 'GMO Flatt Security'}],
 'response': {'communication_strategy': 'Detailed remediation guide published '
                                        'alongside official advisory',
              'containment_measures': 'Patches released for Ruby on Rails and '
                                      'third-party image processing library',
              'remediation_measures': 'Multi-stage remediation process '
                                      'including framework and library updates',
              'third_party_assistance': 'GMO Flatt Security'},
 'title': 'KindaRails2Shell: Critical Ruby on Rails Vulnerability Exposes Web '
          'Applications to Remote Code Execution',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-66066'}