GitHub Advisoryadvisory · RubyGems

GHSA-29g5-m8v7-v564 Measured is vulnerable to Path Traversal attacks during class initialization

MEDIUM Published 2025-07-15 Modified 2025-07-15 Official page ↗
Ecosystem
RubyGems
Packages
measured
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-22
Reviewed
2025-07-15

Affected packages

• RubyGems measured: < 3.2.1 → fixed in 3.2.1

Description

Impact A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the `Measured::Cache::Json class` would be able to instruct the library to read arbitrary files. Patches Users should update to the latest version.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References