Rails · Ruby on Rails
CVE-2014-0130
Ruby on Rails Directory Traversal Vulnerability
What it is
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
CISA: Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 15, 2022
More exploited flaws from Rails
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 7, 2025 | Path Traversal | Ruby on Rails | High 7.5 | 99% |
| Mar 25, 2022 | Directory Traversal | Ruby on Rails | High 7.5 | 96% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.