{"id":"CVE-2016-0752","published":"2016-02-16T02:59:06Z","modified":"2026-06-17T00:38:09Z","title":"Ruby on Rails Directory Traversal Vulnerability","vendor":"Rails","product":"Ruby on Rails","tier":"core","eol":null,"description":{"text":"Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.","provenance":"source","from":"NVD"},"summary":{"text":"A directory traversal flaw in Action View, the view rendering component of Ruby on Rails, affects Rails versions before 3.2.22.1, 4.0.x, 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1. A remote, unauthenticated attacker with network access can read arbitrary files on the server by supplying a \"..\" sequence in a pathname passed to the render method, which applications expose without restriction and without any user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:43Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.95537,"percentile":0.99869,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0752","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-12-17","exploitedFirstSeen":"2019-12-17","ransomware":false,"evidence":[{"url":"https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada","date":"2019-12-17"},{"url":"https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware","date":"2020-12-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html","tags":["Permissions Required"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html","tags":["Permissions Required"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0296.html","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3464","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/01/25/13","tags":["Exploit","Mailing List"]},{"url":"http://www.securityfocus.com/bid/81801","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1034816","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ","tags":["Broken Link"]},{"url":"https://www.exploit-db.com/exploits/40561/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html","tags":["Permissions Required"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html","tags":["Permissions Required"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0296.html","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3464","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/01/25/13","tags":["Exploit","Mailing List"]},{"url":"http://www.securityfocus.com/bid/81801","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1034816","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ","tags":["Broken Link"]},{"url":"https://www.exploit-db.com/exploits/40561/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated attacker exploits public-facing web app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to read arbitrary files","start":167,"end":214}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: directory traversal reads arbitrary local files","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to read arbitrary files","start":167,"end":214}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=4.0.0, <4.1.14.1",">=4.2.0, <4.2.5.1"],"patched":["4.1.14.1","4.2.5.1"],"from":["GHSA-xrr4-p6fq-hjg7"],"provenance":"source"},{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=4.0.0, <4.1.14.1",">=4.2.0, <4.2.5.1","<3.2.22.1"],"patched":["4.1.14.1","4.2.5.1","3.2.22.1"],"from":["GHSA-xrr4-p6fq-hjg7"],"provenance":"source"}],"advisories":[{"id":"GHSA-xrr4-p6fq-hjg7","url":"https://github.com/advisories/GHSA-xrr4-p6fq-hjg7","severity":"HIGH","ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=4.0.0, <4.1.14.1"],"patched":["4.1.14.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xrr4-p6fq-hjg7","url":"https://github.com/advisories/GHSA-xrr4-p6fq-hjg7","severity":"HIGH","ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=4.2.0, <4.2.5.1"],"patched":["4.2.5.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xrr4-p6fq-hjg7","url":"https://github.com/advisories/GHSA-xrr4-p6fq-hjg7","severity":"HIGH","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=4.0.0, <4.1.14.1"],"patched":["4.1.14.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xrr4-p6fq-hjg7","url":"https://github.com/advisories/GHSA-xrr4-p6fq-hjg7","severity":"HIGH","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=4.2.0, <4.2.5.1"],"patched":["4.2.5.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xrr4-p6fq-hjg7","url":"https://github.com/advisories/GHSA-xrr4-p6fq-hjg7","severity":"HIGH","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":["<3.2.22.1"],"patched":["3.2.22.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2017-0333","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0333","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":40561,"url":"https://www.exploit-db.com/exploits/40561","title":"Ruby on Rails - Dynamic Render File Upload / Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2016-10-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-10-17"},"pocGithub":{"count":1,"skipped":1,"earliest":"2016-01-26","earliestUrl":"https://github.com/forced-request/rails-rce-cve-2016-0752","repos":[{"name":"forced-request/rails-rce-cve-2016-0752","url":"https://github.com/forced-request/rails-rce-cve-2016-0752","stars":10,"created":"2016-01-26"}]},"metasploit":[{"name":"Ruby on Rails Dynamic Render File Upload Remote Code Execution","module":"exploit/multi/http/rails_dynamic_render_code_exec","type":"exploit","disclosureDate":"2016-10-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb"}],"first":{"date":"2016-01-26","source":"PoC-in-GitHub","url":"https://github.com/forced-request/rails-rce-cve-2016-0752"},"provenance":"source"},"exploitRefs":["http://www.openwall.com/lists/oss-security/2016/01/25/13","https://www.exploit-db.com/exploits/40561/","https://www.exploit-db.com/exploits/40561"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2016-01-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2016-10-16, Exploit-DB 2016-10-17","url":"https://github.com/forced-request/rails-rce-cve-2016-0752","provenance":"source"},{"date":"2016-02-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0752","provenance":"source"},{"date":"2019-12-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0333","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2229},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2510 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-rails-ruby-on-rails-cve-2016-0752","children":[{"from":"CVE-2016-0752","to":"CVE-2016-2097","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.","from":"CVE.org","in":"CVE-2016-2097"},{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"4.1.14.1","toFixed":"4.1.14.2","daysApart":51},{"kind":"similar","provenance":"machine","score":0.87,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2014-7829","published":"2014-11-18","fixed":"4.2.0.beta4","kev":false,"link":{"from":"CVE-2014-7829","to":"CVE-2016-0752","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"3.2.21","toFixed":"3.2.22.1","daysApart":455},{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"4.1.8","toFixed":"4.1.14.1","daysApart":455}]}},{"cve":"CVE-2015-7581","published":"2016-02-16","fixed":"4.2.5.1","kev":false},{"cve":"CVE-2016-0751","published":"2016-02-16","fixed":"4.2.5.1","kev":false},{"cve":"CVE-2016-0752","published":"2016-02-16","fixed":"4.2.5.1","kev":true},{"cve":"CVE-2016-2098","published":"2016-04-07","fixed":"4.2.5.2","kev":false},{"cve":"CVE-2020-8164","published":"2020-06-19","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false}],"package":"RubyGems:actionpack"}}