HackerFeeds
All CVEs

CVE-2016-0752

HIGH7.5
CISA KEV

Published 2016-02-16 · Updated 2026-06-17 · Source secalert@redhat.com

Summary

CVE-2016-0752 is a high-severity (CVSS 7.5) vulnerability in Rails Ruby on Rails. CISA added it to the Known Exploited Vulnerabilities catalog on March 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 15, 2022. CISA does not currently list it as used in ransomware campaigns. Rails has 3 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 3 known-exploited Rails vulnerabilities →

Description

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22CWE-22

CISA Known-Exploited Vulnerability

Product: Rails — Ruby on Rails

Name: Ruby on Rails Directory Traversal Vulnerability

Date added: 2022-03-25 · Due: 2022-04-15

Required action: Apply updates per vendor instructions.

References

View on NVD