Every CVE Search/ Get API key

CVE-2014-7818

actionpack vulnerable to Path Traversal

4.3 MediumFix available

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Exploit likelihood

3.46%Down 9.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Record
CVE-2014-7818
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Record
CVE-2014-7818
Updated
2026-11-02
EUVDEUVD-2017-0149 No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Record
EUVD-2017-0149
Updated
2026-11-03
GitHub AdvisoriesGHSA-29gr-w57f-rpfw No score

actionpack vulnerable to Path Traversal

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Record
GHSA-29gr-w57f-rpfw
Weakness
CWE-22
Updated
2026-11-02
OSV No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Record
CVE-2014-7818
Updated
2026-11-02
OSVDEBIAN-CVE-2014-7818 No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Record
DEBIAN-CVE-2014-7818
Updated
2026-11-02
OSVGHSA-29gr-w57f-rpfw No score

actionpack vulnerable to Path Traversal

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Record
GHSA-29gr-w57f-rpfw
Weakness
CWE-22
Updated
2026-11-02
OSVopenSUSE-SU-2024:10332-1 No score

ruby2.2-rubygem-actionpack-4_2-4.2.7.1-1.1 on GA media

These are all security issues fixed in the ruby2.2-rubygem-actionpack-4_2-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10332-1
Updated
2026-11-02
OSVSUSE-SU-2015:0863-1 No score

Security update for SUSE Studio

This update provides SUSE Studio 1.3.10, including Amazon's EC2 support for SUSE Linux Enterprise 12 appliances.

Additionally, the update includes fixes for the following issues:

* #904372 - Arbitrary file existence disclosure in sprockets gem
  (CVE-2014-7819)
* #904375 - Arbitrary file existence disclosure in Action Pack gem
  (CVE-2014-7818)
* #918203 - Arbitrary file existence disclosure in Studio Onsite
  (CVE-2014-7829)
* #852794 - SLES 11-SP3 templates fail to build x86_64 EC2 images
* #914765 - Change of appliance name is not displayed in appliance's
  change log
* #887893 - Change log not accessible via API
* #918239 - Failure to create new appliances after upgrade to Studio
  Onsite 1.3.9
* #918395 - Remove 32bit as target for building EC2 appliances
* #912512 - Studio doesn't allow duplicated repositories
* #880078 - Studio packages contain files that get modified (by Studio)
  after installation.
* #919037 - Can't open appliance on Gallery: undefined
  restructure_unsupportable_packages method.

Security Issues:

* CVE-2014-7819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819>
* CVE-2014-7818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818>
* CVE-2014-7829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829>
Record
SUSE-SU-2015:0863-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actionpack
RubyGems
 3.0.0 up to 3.2.20
3.2.20
actionpack
RubyGems
 4.0.0 up to 4.0.11
4.0.11
actionpack
RubyGems
 4.1.0 up to 4.1.7
4.1.7
actionpack
RubyGems
 4.2.0.beta1 up to 4.2.0.beta3
4.2.0.beta3
rails
Debian:12
 before 2:4.1.8-1
2:4.1.8-1
rails
Debian:13
 before 2:4.1.8-1
2:4.1.8-1
rails
Debian:14
 before 2:4.1.8-1
2:4.1.8-1
actionpack
RubyGems
 3.0.0 up to 3.2.20, plus listed versions
3.0.13.0.103.0.10.rc13.0.113.0.12
Show 45 moreShow less
3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10
3.2.20
actionpack
RubyGems
 4.0.0 up to 4.0.11, plus listed versions
4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4
Show 15 moreShow less
4.0.104.0.10.rc14.0.10.rc24.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.84.0.9
4.0.11
actionpack
RubyGems
 4.1.0 up to 4.1.7, plus listed versions
4.1.14.1.24.1.2.rc14.1.2.rc24.1.2.rc3
Show 6 moreShow less
4.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc2
4.1.7
actionpack
RubyGems
 4.2.0.beta1 up to 4.2.0.beta3, plus listed versions
4.2.0.beta2
4.2.0.beta3

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7818 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published November 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.46%, the 89th percentile. Fixed in actionpack 3.2.20.

References

Show 20 moreShow less
This page doesn't list everything

Left out here: 53 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open