Last Updated: 2026-08-01T19:50:50Z
CVSSv3: no cvss yet
KindaRails2Shell
Inspired by wp2shell, rails apps using ActiveStorage and default vips processor are vulnerable to Arbitrary File Read and Remote Code Execution via image upload from untrusted users. Kinda, because there are requirements, including very common configuration and default behaviors.
No PoC from the research team or any technical details have been released yet, in order to give users time to patch.
Versions Affected:
| Rails/ activestorage versions | Fixed in | Note |
|---|---|---|
| 6.0.0 - 6.1.7.10 | 7.2.3.2 | non-default config required |
| 7.0.0 - 7.2.3.1 | 7.2.3.2 | default config affected |
| 8.0.0 - 8.0.5 | 8.0.5.1 | default config affected |
| 8.1.0 - 8.1.3 | 8.1.3.1 | default config affected |
A utility from rails was created to determine:
- Was I vulnerable, and for how long?
- Was I exploited, and if so, what left the building?
Actions:
Update your rails/activestorage , and update vips. A WAF can help, but the researchers don’t recommend relying on it. Additionally, if you can’t upgrade, setting VIPS_BLOCK_UNTRUSTED environment var will block exploitation.
Sources: