How severe is CVE-2016-0752?

CVE-2016-0752 has a CVSS 3.1 base score of 7.5 (HIGH). EPSS estimates a 95.5% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2016-0752: Ruby on Rails Directory Traversal

CISA Known Exploited Vulnerabilities

Ruby on Rails Directory Traversal Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-03-25

Remediation due

2022-04-15

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2016-0752

Description

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Severity

CVSS 3.1 · CISA7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
-	-	n/a

References

12 Links

Vendor advisories

Exploits & PoCs

40561

Mailing lists

Vulnerability databases

Record Details

Published

2016-02-16

Last updated

2025-10-21

Assigner (CNA)

redhat

Credited to

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.