CVE-2014-0130

actionpack Path Traversal vulnerability

7.5 HighIn KEVPublic exploitFix available

CVE-2014-0130 is a high vulnerability (CVSS 7.5) in Rails Ruby On Rails, published May 7, 2014. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 53.7%, the 98th percentile. Fixed in actionpack 3.2.18.

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

53.7%Up 38.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2014-0130
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List 7.5

Record: CVE-2014-0130
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2017-0180 7.5

Record: EUVD-2017-0180
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6x85-j5j2-27jx 7.5

actionpack Path Traversal vulnerability

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Record: GHSA-6x85-j5j2-27jx
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
Weakness: CWE-22
Updated: 2026-11-02

CISA KEV No score

Ruby on Rails Directory Traversal Vulnerability

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

Record: CVE-2014-0130
Weakness: CWE-22
Updated: 2026-11-02

OSVGHSA-6x85-j5j2-27jx 7.5

actionpack Path Traversal vulnerability

Record: GHSA-6x85-j5j2-27jx
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
Weakness: CWE-22
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-0130 7.5

Record: UBUNTU-CVE-2014-0130
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2014-0303 No score

Updated ruby-actionpack packages fix security issues

Updated ruby-actionpack and ruby-activerecord packages fix security vulnerabilities:

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 4.0.5, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request (CVE-2014-0130).

PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord in Ruby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using carefully crafted values (CVE-2014-3483).

The associated Ruby on Rails packages have been updated to version 4.0.8, to address these and other issues.

Record: MGASA-2014-0303
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`actionpack` RubyGems	3.0.0 up to 3.2.18	3.2.18
`actionpack` RubyGems	4.0.0 up to 4.0.5	4.0.5
`actionpack` RubyGems	4.1.0 up to 4.1.1	4.1.1
`ruby-actionpack-3.2` Debian:7	before 3.2.6-6+deb7u2, plus listed versions 3.2.6-63.2.6-6+deb7u1	3.2.6-6+deb7u2
`actionpack` RubyGems	3.0.0 up to 3.2.18, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 45 moreShow less 3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10	3.2.18
`actionpack` RubyGems	4.0.0 up to 4.0.5, plus listed versions 4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4 Show 4 moreShow less 4.0.24.0.34.0.44.0.4.rc1	4.0.5
`ruby-actionmailer` Mageia:4	before 4.0.8-1.mga4	4.0.8-1.mga4
`ruby-actionpack` Mageia:4	before 4.0.8-1.mga4	4.0.8-1.mga4
`ruby-activemodel` Mageia:4	before 4.0.8-1.mga4	4.0.8-1.mga4
`ruby-activerecord` Mageia:4	before 4.0.8-1.mga4	4.0.8-1.mga4

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`ruby-activesupport` Mageia:4	before 4.0.8-1.mga4	4.0.8-1.mga4
`ruby-rails` Mageia:4	before 4.0.8-1.mga4	4.0.8-1.mga4
`ruby-railties` Mageia:4	before 4.0.8-1.mga4	4.0.8-1.mga4
`ruby193-rubygem-actionpack` Red Hat:rhel_software_collections:1::el6	before 1:3.2.8-5.5.el6	1:3.2.8-5.5.el6
`ruby193-rubygem-actionpack-doc` Red Hat:rhel_software_collections:1::el6	before 1:3.2.8-5.5.el6	1:3.2.8-5.5.el6
`cfme` Red Hat:cloudforms_managementengine:5::el6	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`cfme-appliance` Red Hat:cloudforms_managementengine:5::el6	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`cfme-debuginfo` Red Hat:cloudforms_managementengine:5::el6	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`cfme-lib` Red Hat:cloudforms_managementengine:5::el6	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`mingw32-cfme-host` Red Hat:cloudforms_managementengine:5::el6	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`ruby193-rubygem-actionpack` Red Hat:cloudforms_managementengine:5::el6	before 1:3.2.13-8.el6cf	1:3.2.13-8.el6cf