GitHub Advisoryadvisory · RubyGems

GHSA-6x85-j5j2-27jx actionpack Path Traversal vulnerability

HIGH Published 2017-10-24 Modified 2025-10-24 Official page ↗
Aliases
CVE-2014-0130
Ecosystem
RubyGems
Packages
actionpack
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• RubyGems actionpack: >= 3.0.0, < 3.2.18 → fixed in 3.2.18 • RubyGems actionpack: >= 4.0.0, < 4.0.5 → fixed in 4.0.5 • RubyGems actionpack: >= 4.1.0, < 4.1.1 → fixed in 4.1.1

Description

Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Related

Alias · CVE (1)

  • CVE-2014-0130 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References