CVE-2015-7314
Gollum Exposure of Sensitive Information
CVE-2015-7314 is a medium vulnerability (CVSS 4.3) in Gollum Project Gollum, published October 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in gollum 4.0.1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.88%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.0.1gollum +1 more
Description
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gollumRubyGems | before 4.0.1 | 4.0.1 |
gollumRubyGems | before 4.0.1, plus listed versions 1.0.01.0.11.1.01.1.11.2.0 Show 45 moreShow less1.2.11.3.01.3.11.4.21.4.32.0.02.1.02.1.102.1.22.1.32.1.42.1.62.1.72.1.82.1.92.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.122.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.102.4.112.4.122.4.132.4.14 | 4.0.1 |
What each source reports
NVD Score used
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
CVE-2015-7314- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
CVE-2015-7314- Updated
- 2026-11-02
EUVDEUVD-2018-0408No score
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
EUVD-2018-0408- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m2q3-53fq-7h66No score
Gollum Exposure of Sensitive Information
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
GHSA-m2q3-53fq-7h66- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-m2q3-53fq-7h66No score
Gollum Exposure of Sensitive Information
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
- Record
GHSA-m2q3-53fq-7h66- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1
jvn.jp/en/jp/JVN27548431/index.html
jvndb.jvn.jp/jvndb/JVNDB-2015-000149
openwall.com/lists/oss-security/2015/09/22/12
nvd.nist.gov/vuln/detail/CVE-2015-7314
Left out here: 20 versions. The JSON record has them.