VULNERABILITY INTELLIGENCE

CVE-2016-0752

CVSS score7.5 HIGH
EPSS probability95.54%
CISA KEVKnown exploited vulnerability
Published2016-02-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Known Exploited Vulnerability

Ruby on Rails Directory Traversal Vulnerability

Vendor / product: Rails / Ruby on Rails

Description

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references