Every CVE Search/ Get API key

CVE-2014-0130

actionpack Path Traversal vulnerability

7.5 HighIn KEVPublic exploitFix available

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

53.7%Up 38.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Record
CVE-2014-0130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List 7.5

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Record
CVE-2014-0130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2017-0180 7.5

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Record
EUVD-2017-0180
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-6x85-j5j2-27jx 7.5

actionpack Path Traversal vulnerability

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Record
GHSA-6x85-j5j2-27jx
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
Weakness
CWE-22
Updated
2026-11-02
CISA KEV No score

Ruby on Rails Directory Traversal Vulnerability

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

Record
CVE-2014-0130
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-6x85-j5j2-27jx 7.5

actionpack Path Traversal vulnerability

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Record
GHSA-6x85-j5j2-27jx
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
Weakness
CWE-22
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0130 7.5

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Record
UBUNTU-CVE-2014-0130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2014-0303 No score

Updated ruby-actionpack packages fix security issues

Updated ruby-actionpack and ruby-activerecord packages fix security vulnerabilities:

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 4.0.5, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request (CVE-2014-0130).

PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord in Ruby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using carefully crafted values (CVE-2014-3483).

The associated Ruby on Rails packages have been updated to version 4.0.8, to address these and other issues.

Record
MGASA-2014-0303
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actionpack
RubyGems
 3.0.0 up to 3.2.18
3.2.18
actionpack
RubyGems
 4.0.0 up to 4.0.5
4.0.5
actionpack
RubyGems
 4.1.0 up to 4.1.1
4.1.1
ruby-actionpack-3.2
Debian:7
 before 3.2.6-6+deb7u2, plus listed versions
3.2.6-63.2.6-6+deb7u1
3.2.6-6+deb7u2
actionpack
RubyGems
 3.0.0 up to 3.2.18, plus listed versions
3.0.13.0.103.0.10.rc13.0.113.0.12
Show 45 moreShow less
3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10
3.2.18
actionpack
RubyGems
 4.0.0 up to 4.0.5, plus listed versions
4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4
Show 4 moreShow less
4.0.24.0.34.0.44.0.4.rc1
4.0.5
ruby-actionmailer
Mageia:4
 before 4.0.8-1.mga4
4.0.8-1.mga4
ruby-actionpack
Mageia:4
 before 4.0.8-1.mga4
4.0.8-1.mga4
ruby-activemodel
Mageia:4
 before 4.0.8-1.mga4
4.0.8-1.mga4
ruby-activerecord
Mageia:4
 before 4.0.8-1.mga4
4.0.8-1.mga4
Show 11 moreShow less
Affected packages
PackageAffectedFixed
ruby-activesupport
Mageia:4
 before 4.0.8-1.mga4
4.0.8-1.mga4
ruby-rails
Mageia:4
 before 4.0.8-1.mga4
4.0.8-1.mga4
ruby-railties
Mageia:4
 before 4.0.8-1.mga4
4.0.8-1.mga4
ruby193-rubygem-actionpack
Red Hat:rhel_software_collections:1::el6
 before 1:3.2.8-5.5.el6
1:3.2.8-5.5.el6
ruby193-rubygem-actionpack-doc
Red Hat:rhel_software_collections:1::el6
 before 1:3.2.8-5.5.el6
1:3.2.8-5.5.el6
cfme
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.2.4.2-1.el6cf
0:5.2.4.2-1.el6cf
cfme-appliance
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.2.4.2-1.el6cf
0:5.2.4.2-1.el6cf
cfme-debuginfo
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.2.4.2-1.el6cf
0:5.2.4.2-1.el6cf
cfme-lib
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.2.4.2-1.el6cf
0:5.2.4.2-1.el6cf
mingw32-cfme-host
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.2.4.2-1.el6cf
0:5.2.4.2-1.el6cf
ruby193-rubygem-actionpack
Red Hat:cloudforms_managementengine:5::el6
 before 1:3.2.13-8.el6cf
1:3.2.13-8.el6cf

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubomarkurt/cve-2014-01302014-05-08

History

History
RecordedChangedSources
exploitation
affected
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0130 is a high vulnerability (CVSS 7.5) in Rails Ruby On Rails, published May 7, 2014. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 53.7%, the 98th percentile. Fixed in actionpack 3.2.18.

References

Show 48 moreShow less
This page doesn't list everything

Left out here: 51 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open