Live › vulnerability › CVE-2016-0752
Go to dashboardAction View in Ruby on Rails has a directory traversal flaw that lets remote attackers read arbitrary files from the server. CISA lists it as actively exploited in the wild, and the EPSS exploitation probability is 0.955.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Rails Ruby on Rails | vendor | – | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
This page as .md · .json · in your agent: get_signal("CVE-2016-0752")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.