CTI · reviewed · 2026-09-27

Ruby on Rails Active Storage Flaw (CVE-2026-66066, CVSS 9.5): Unauthenticated Server File Read via Image Uploads

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1005 Data from Local System Collection
• T1552 Unsecured Credentials Credential Access

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://socprime.com/blog/cve-2026-66066-critical-rails-flaw-exposes-server-files-via-image-uploads/
• https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve
• https://blog.flatt.tech/entry/kindarails2shell_rails
• https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
• https://www.bleepingcomputer.com/news/security/rails-patches-critical-active-storage-flaw-with-rce-potential/
• https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066
• https://www.urbanmind.net/search?tag=cybersecurity