CVE-2026-66066 — KindaRails2Shell

On the 29th of July, 2026, CVE-2026-66066 was announced, also known as "KindaRails2Shell".

This is a critical vulnerability in Ruby on Rails' Active Storage component, allowing arbitrary file read and possible remote code execution via its libvips-based image-variant processing. Exploitation requires that the application uses Active Storage to accept file uploads.

Impact to LiquidFiles

Does this impact LiquidFiles — No.

LiquidFiles does not use Active Storage. Every file upload and attachment in LiquidFiles is handled by our own attachment pipeline, which writes directly to the filesystem. There are no Active Storage database tables, models, or routes in any LiquidFiles release, so there is no code path by which an uploaded file can reach the affected component. This applies to every currently supported LiquidFiles version.

This is a Rails issue, not a libvips issue. libvips has flagged its untrusted image loaders and provided a switch to block them since version 8.13 (May 2022) — Active Storage simply never enabled it. No libvips update is required to address CVE-2026-66066.

A note on vulnerability scanners

Vulnerability scanners typically detect this class of CVE by matching the installed Rails library version rather than checking whether Active Storage is actually in use. Because of this, a scan of a LiquidFiles appliance may still flag CVE-2026-66066 — that would be a false positive for the reason described above.

LiquidFiles v4.2.14 ships Rails 7.2.3.1, and v4.1.12 ships Rails 7.0.8.7, both earlier than the versions named in the advisory.

When will this be fixed

LiquidFiles will move to a fixed Rails version in an upcoming release so this no longer appears in scanner reports. See our Secure Development Practices page for more on how we track and respond to upstream advisories.