---
id: "CVE-2016-0752"
kind: "vulnerability"
aliases: ["CVE-2016-0752"]
title: "Rails Ruby on Rails: Ruby on Rails Directory Traversal Vulnerability"
severity: "high"
cvss: 7.5
epss: 0.95537
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Rails Ruby on Rails", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "rails", "ruby", "runtime", "self-hosted"]
not_affected_if: ["static-export"]
published_at: "2016-02-16T02:59:06+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0752", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-0752", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0752", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Rails Ruby on Rails: Ruby on Rails Directory Traversal Vulnerability

Action View in Ruby on Rails has a directory traversal flaw that lets remote attackers read arbitrary files from the server. CISA lists it as actively exploited in the wild, and the EPSS exploitation probability is 0.955.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Rails Ruby on Rails affected ? fixed ?

## Fix

Upgrade Rails to a release that includes the vendor fix for CVE-2016-0752; the sources do not name the exact fixed version. Apply updates per vendor instructions.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0752
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-0752
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-0752

## From the sources

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_