Description
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| https://github.com/rails/rails | Rails / https://github.com/rails/rails | 4.2.11.1 | affected |
| https://github.com/rails/rails | Rails / https://github.com/rails/rails | 5.0.7.2 | affected |
| https://github.com/rails/rails | Rails / https://github.com/rails/rails | 5.1.6.2 | affected |
| https://github.com/rails/rails | Rails / https://github.com/rails/rails | 5.2.2.1 | affected |