{"id":"CVE-2016-0752","kind":"vulnerability","aliases":["CVE-2016-0752"],"related":[],"title":"Rails Ruby on Rails: Ruby on Rails Directory Traversal Vulnerability","description":"Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.","summary":"Action View in Ruby on Rails has a directory traversal flaw that lets remote attackers read arbitrary files from the server. CISA lists it as actively exploited in the wild, and the EPSS exploitation probability is 0.955.","severity":"high","cvss":7.5,"epss":0.95537,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Rails Ruby on Rails","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","rails","ruby","runtime","self-hosted"],"not_affected_if":["static-export"],"how_to_check":null,"fix":"Upgrade Rails to a release that includes the vendor fix for CVE-2016-0752; the sources do not name the exact fixed version. Apply updates per vendor instructions.","status":"open","published_at":"2016-02-16T02:59:06+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:00+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:22:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Rails to a release that includes the vendor fix for CVE-2016-0752; the sources do not name the exact fixed version. Apply updates per vendor instructions.","reach":"internet","impact":"high","summary":"Action View in Ruby on Rails has a directory traversal flaw that lets remote attackers read arbitrary files from the server. CISA lists it as actively exploited in the wild, and the EPSS exploitation probability is 0.955.","category":"runtime","who_cares":["rails","ruby","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads arbitrary files on the server, including secrets and config.","analyst_note":"Find the fixed Rails versions and affected version ranges from the NVD or Rails security advisory, and confirm the exact vulnerable Action View code path so teams can check their version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["static-export"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000468,"input_tokens":2823,"output_tokens":371,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0752':13A,16A '-2016':12A,15A '0.955':64B '3.2.22.1':76C '4.0':77C '4.1':80C '4.1.14.1':83C '4.2':84C '4.2.5.1':87C '5':89C '5.0.0':92C 'action':28B,69C 'activ':53B 'allow':94C 'applic':104C 'arbitrari':44B,99C 'attack':42B,96C 'beta1.1':93C 'cisa':49B 'cve':11A,14A 'directori':8A,36B,65C 'dot':115C,116C 'epss':60B 'exploit':21B,54B,61B 'file':45B,100C 'flaw':38B 'host':27B 'let':40B 'leverag':102C 'list':50B 'method':111C 'on':19A 'pathnam':119C 'probabl':62B 'provid':113C 'rail':1A,4A,7A,22B,33B,74C 'rails':17A,20A 'read':43B,98C 'remot':41B,95C 'render':110C 'rubi':2A,5A,23B,31B,72C 'ruby':18A 'runtim':24B 'self':26B 'self-host':25B 'server':48B 'travers':9A,37B,66C 'unrestrict':106C 'use':107C 'view':29B,70C 'vulner':10A,67C 'wild':57B 'x':78C,81C,85C,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-02-16T02:59:06+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-0752","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0752","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2016-0752","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0752","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-0752","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0752","severity":null,"published_at":"2016-02-16T02:59:06+00:00","modified_at":"2026-06-17T00:38:09+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}