Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution

Description

This module exploits CVE-2026-66066 in Ruby on Rails Active Storage when the application uses the Vips variant processor and accepts untrusted image uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text files accessible to the Rails worker through a PNG representation response.

The module recovers secret_key_base from the process environment, Rails local secrets, encrypted credentials, or the legacy secrets.yml(.enc) files. It then forges a serializer-compatible variation whose ImageProcessing apply step reaches Kernel#spawn with a command payload, or Kernel#eval with a native Ruby payload when the Ruby target is selected. Neither path requires a Marshal object gadget. The Ruby target's initial code execution does not require a Unix shell or a fetch utility on the target.

The file-read stage needs a genuine signed Active Storage variation key. It can use VARIATION_KEY directly, reuse a representation URL from the application, or create one through an application upload form. Supplying SECRET_KEY_BASE skips the arbitrary file-read stage and lets the module construct the standard representation route itself.

The file-read stage affects Rails 6.0 and 6.1, Rails 7.0 through 7.2.3.1, Rails 8.0.0 through 8.0.5, and Rails 8.1.0 through 8.1.3. It is fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. The RCE stage combines an incomplete Vips-side fix for CVE-2025-24293 with ImageProcessing 1.x method dispatch; ImageProcessing 2.x blocks this chain.