CVE-2016-0752

rubyonrails rails, opensuse leap, opensuse

Published 16 Feb 2016 · updated 17 Jun 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

References

lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html · Permissions Required
lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html · Permissions Required
lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-updates/2016-02/msg00034.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-updates/2016-02/msg00043.html · Mailing List, Third Party Advisory
rhn.redhat.com/errata/RHSA-2016-0296.html · Third Party Advisory
www.debian.org/security/2016/dsa-3464 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2016/01/25/13 · Exploit, Mailing List
www.securityfocus.com/bid/81801 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1034816 · Broken Link, Third Party Advisory, VDB Entry
groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ · Broken Link
www.exploit-db.com/exploits/40561/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752 · US Government Resource