CVE-2016-0752
- State
- Published
- Severity
- 7.5 High
- Published
- Feb 16, 2016
- Updated
- Oct 21, 2025
- Reserved
- Dec 16, 2015
Description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 40561exploit
- openSUSE-SU-2016:0372vendor-advisory
- openSUSE-SU-2016:0363vendor-advisory
- [oss-security] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action Viewmailing-list
- FEDORA-2016-97002ad37bvendor-advisory
- SUSE-SU-2016:1146vendor-advisory
- 81801vdb-entry
- 1034816vdb-entry
- FEDORA-2016-fa0dec2360vendor-advisory
- [ruby-security-ann] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action Viewmailing-list
- DSA-3464vendor-advisory
- RHSA-2016:0296vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.