Every CVE Search/ Get API key

CVE-2014-7829

Directory traversal vulnerability in actionpack

5.0 MediumFix available

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Exploit likelihood

4.16%Down 11.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Record
CVE-2014-7829
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Record
CVE-2014-7829
Updated
2026-11-02
EUVDEUVD-2017-0245 No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Record
EUVD-2017-0245
Updated
2026-11-03
GitHub AdvisoriesGHSA-h56m-vwxc-3qpw No score

Directory traversal vulnerability in actionpack

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Record
GHSA-h56m-vwxc-3qpw
Weakness
CWE-22
Updated
2026-11-02
OSV No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Record
CVE-2014-7829
Updated
2026-11-02
OSVDEBIAN-CVE-2014-7829 No score

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Record
DEBIAN-CVE-2014-7829
Updated
2026-11-02
OSVGHSA-h56m-vwxc-3qpw No score

Directory traversal vulnerability in actionpack

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Record
GHSA-h56m-vwxc-3qpw
Weakness
CWE-22
Updated
2026-11-02
OSVopenSUSE-SU-2024:10332-1 No score

ruby2.2-rubygem-actionpack-4_2-4.2.7.1-1.1 on GA media

These are all security issues fixed in the ruby2.2-rubygem-actionpack-4_2-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10332-1
Updated
2026-11-02
OSVSUSE-SU-2015:0863-1 No score

Security update for SUSE Studio

This update provides SUSE Studio 1.3.10, including Amazon's EC2 support for SUSE Linux Enterprise 12 appliances.

Additionally, the update includes fixes for the following issues:

* #904372 - Arbitrary file existence disclosure in sprockets gem
  (CVE-2014-7819)
* #904375 - Arbitrary file existence disclosure in Action Pack gem
  (CVE-2014-7818)
* #918203 - Arbitrary file existence disclosure in Studio Onsite
  (CVE-2014-7829)
* #852794 - SLES 11-SP3 templates fail to build x86_64 EC2 images
* #914765 - Change of appliance name is not displayed in appliance's
  change log
* #887893 - Change log not accessible via API
* #918239 - Failure to create new appliances after upgrade to Studio
  Onsite 1.3.9
* #918395 - Remove 32bit as target for building EC2 appliances
* #912512 - Studio doesn't allow duplicated repositories
* #880078 - Studio packages contain files that get modified (by Studio)
  after installation.
* #919037 - Can't open appliance on Gallery: undefined
  restructure_unsupportable_packages method.

Security Issues:

* CVE-2014-7819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819>
* CVE-2014-7818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818>
* CVE-2014-7829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829>
Record
SUSE-SU-2015:0863-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actionpack
RubyGems
 3.0.0 up to 3.2.21
3.2.21
actionpack
RubyGems
 4.0.0 up to 4.0.12
4.0.12
actionpack
RubyGems
 4.1.0 up to 4.1.8
4.1.8
actionpack
RubyGems
 4.2.0.beta1 up to 4.2.0.beta4
4.2.0.beta4
rails
Debian:12
 before 2:4.1.8-1
2:4.1.8-1
rails
Debian:13
 before 2:4.1.8-1
2:4.1.8-1
rails
Debian:14
 before 2:4.1.8-1
2:4.1.8-1
actionpack
RubyGems
 4.1.0 up to 4.1.8, plus listed versions
4.1.14.1.24.1.2.rc14.1.2.rc24.1.2.rc3
Show 8 moreShow less
4.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.1
4.1.8
actionpack
RubyGems
 3.0.0 up to 3.2.21, plus listed versions
3.0.13.0.103.0.10.rc13.0.113.0.12
Show 45 moreShow less
3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10
3.2.21
actionpack
RubyGems
 4.0.0 up to 4.0.12, plus listed versions
4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4
Show 17 moreShow less
4.0.104.0.10.rc14.0.10.rc24.0.114.0.11.14.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.84.0.9
4.0.12
actionpack
RubyGems
 4.2.0.beta1 up to 4.2.0.beta4, plus listed versions
4.2.0.beta24.2.0.beta3
4.2.0.beta4

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7829 is a medium vulnerability (CVSS 5.0) in Rubyonrails Rails, published November 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.16%, the 90th percentile. Fixed in actionpack 3.2.21.

References

Show 22 moreShow less
This page doesn't list everything

Left out here: 54 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open