CVE-2007-6612
Mongrel vulnerable to directory traversal via double-encoded sequences
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").
- Record
CVE-2007-6612- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").
- Record
CVE-2007-6612- Updated
- 2026-11-02
EUVDEUVD-2022-4514 No score
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").
- Record
EUVD-2022-4514- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m7r6-43v2-49vf No score
Mongrel vulnerable to directory traversal via double-encoded sequences
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 (1.0.3 and prior are not affected) and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (.%252e).
- Record
GHSA-m7r6-43v2-49vf- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-m7r6-43v2-49vf No score
Mongrel vulnerable to directory traversal via double-encoded sequences
Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 (1.0.3 and prior are not affected) and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (.%252e).
- Record
GHSA-m7r6-43v2-49vf- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6612 is a medium vulnerability (CVSS 6.4) in Mongrel, published January 3, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. Fixed in mongrel 1.0.5.
References
rubyforge.org/pipermail/mongrel-users/2007-December/004736.html
mongrel.rubyforge.org/news.html
securityfocus.com/bid/27133
secunia.com/advisories/28323
osvdb.org/39866
us-cert.gov/cas/techalerts/TA08-150A.html
Show 11 moreShow less
lists.apple.com/archives/security-announce/2008//May/msg00001.html
vupen.com/english/advisories/2008/1697
nvd.nist.gov/vuln/detail/CVE-2007-6612
web.archive.org/web/20080111034049/http://rubyforge.org/pipermail/mongrel-users/2007-December/004743.html
github.com/advisories/GHSA-m7r6-43v2-49vf