CVE-2015-7314
Gollum Exposure of Sensitive Information
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Exploit likelihood
What each source reports
NVD Score used
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
CVE-2015-7314- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
CVE-2015-7314- Updated
- 2026-11-02
EUVDEUVD-2018-0408 No score
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
EUVD-2018-0408- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m2q3-53fq-7h66 No score
Gollum Exposure of Sensitive Information
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
GHSA-m2q3-53fq-7h66- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-m2q3-53fq-7h66 No score
Gollum Exposure of Sensitive Information
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
GHSA-m2q3-53fq-7h66- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gollumRubyGems |
before 4.0.1 | 4.0.1 |
gollumRubyGems |
before 4.0.1, plus listed versions 1.0.01.0.11.1.01.1.11.2.0 Show 45 moreShow less1.2.11.3.01.3.11.4.21.4.32.0.02.1.02.1.102.1.22.1.32.1.42.1.62.1.72.1.82.1.92.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.122.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.102.4.112.4.122.4.132.4.14 |
4.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7314 is a medium vulnerability (CVSS 4.3) in Gollum Project Gollum, published October 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in gollum 4.0.1.
References
github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1
jvn.jp/en/jp/JVN27548431/index.html
jvndb.jvn.jp/jvndb/JVNDB-2015-000149
openwall.com/lists/oss-security/2015/09/22/12
nvd.nist.gov/vuln/detail/CVE-2015-7314
Left out here: 20 versions. The JSON record has them.