GHSA-29g5-m8v7-v564
Measured is vulnerable to Path Traversal attacks during class initialization
Impact
A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files.
Patches
Users should update to the latest version.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Measured is vulnerable to Path Traversal attacks during class initialization
Impact
A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files.
Patches
Users should update to the latest version.
- Record
GHSA-29g5-m8v7-v564- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Measured is vulnerable to Path Traversal attacks during class initialization
Impact
A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files.
Patches
Users should update to the latest version.
- Record
GHSA-29g5-m8v7-v564- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
measuredRubyGems | before 3.2.1 | 3.2.1 |
measuredRubyGems | before 3.2.1, plus listed versions 0.0.10.0.100.0.110.0.120.0.2 Show 35 moreShow less0.0.30.0.40.0.60.0.70.0.80.0.91.0.01.1.01.2.01.3.01.3.11.4.01.5.01.6.02.0.02.0.0.pre12.0.0.pre22.0.0.pre32.0.0.pre42.1.02.2.02.3.02.4.02.5.02.5.12.5.22.6.02.7.02.7.12.8.02.8.12.8.23.0.03.1.03.2.0 | 3.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-29g5-m8v7-v564 is a medium vulnerability (CVSS 4.9) in measured, published July 15, 2025. No source lists public exploit code. Fixed in measured 3.2.1.