ZeroDay Findings
Sign inSign up

Findings

CVE-2014-0130

Ruby on Rails Directory Traversal Vulnerability

Published May 7, 2014 · updated Jun 16, 2026 · redhat subscription asset manager

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Timeline

Detection, updates, and resolution for this record.

  1. May 7, 2014 · Catalog

    Detected

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe redhat/enterprise linux server6.0
  • cpe redhat/subscription asset managerversion unspecified
  • cpe rubyonrails/railsversion unspecified
  • vendor Rails Ruby on Railsversion unspecified

Sources

  • CISA KEVCVE-2014-0130

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

    cisa.gov
  • CVE.orgCVE-2014-0130

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2014-0130

    30-day exploitation probability 53.7%

    first.org
  • NIST NVDCVE-2014-0130

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to rea

    nvd.nist.gov

References

CVE-2014-0130 · ZeroDay Findings