Vulnerability record · CVE-2016-0752 · published 16 February 2016
CVE-2016-0752: Ruby on Rails Action View render method directory traversal
Rubyonrails · Rails
Action View in Ruby on Rails fails to properly sanitize pathnames passed to the render method, allowing directory traversal via '..' sequences. An application that passes user-controlled input to render without restriction can be tricked into reading arbitrary files from the server filesystem. This exposes configuration files, credentials, and source code to unauthenticated remote attackers.
Description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
critical priorityThe vulnerability is in CISA KEV with a very high EPSS score, has public exploits, and allows unauthenticated arbitrary file read.
What it is
Action View in Ruby on Rails fails to properly sanitize pathnames passed to the render method, allowing directory traversal via '..' sequences. An application that passes user-controlled input to render without restriction can be tricked into reading arbitrary files from the server filesystem. This exposes configuration files, credentials, and source code to unauthenticated remote attackers.
Impact
An attacker can read arbitrary files on the server, including secrets, database credentials, and application source code. This can lead to further compromise of the application and its data.
Attack surface
Reachable over the network via HTTP requests to an application that uses the render method with user-supplied path input. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
CVE-2016-0752 is listed in CISA KEV (added 2022-03-25) and has an EPSS probability of 0.95537 (99.867th percentile), indicating active exploitation. Public exploit code is referenced in Exploit-DB and Openwall.
What to do
- Apply the vendor patches: upgrade Rails to 3.2.22.1, 4.1.14.1, 4.2.5.1, or 5.0.0.beta1.1 or later.
- Update distribution packages (Debian, Red Hat, openSUSE/SUSE) per their security advisories.
- Audit application code for render calls that accept user-controlled pathnames and restrict them to a safe allowlist.
- Validate and sanitize all file path input, rejecting '..' sequences and absolute paths.
- Run the application with least privilege to limit the impact of arbitrary file reads.
Detection
- Monitor HTTP requests for path traversal patterns such as '../' or encoded variants in parameters that feed render calls.
- Review web server and application logs for unusual file access attempts or errors indicating traversal.
- Use file integrity monitoring to detect unexpected reads of sensitive files like /etc/passwd or configuration files.
- Deploy WAF rules to block directory traversal attempts targeting Rails applications.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-0752 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "Ruby on Rails Directory Traversal Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-0752 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-0752), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
