# CVE-2016-0752

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

- Page: https://www.vulneraibility.com/cve/CVE-2016-0752
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15
- EPSS: 95.54% (percentile 99.9)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 2 GitHub proofs of concept (first 2016-01-26)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2025-02-07)
- Weakness: CWE-22
- Published: 2016-02-16

## Affected

- rubyonrails:rails
- opensuse:leap
- opensuse:opensuse
- suse:linux_enterprise_module_for_containers
- debian:debian_linux
- redhat:software_collections

## References

- [exploit] https://www.exploit-db.com/exploits/40561/
- [advisory] http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
- [advisory] http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
- [other] http://www.openwall.com/lists/oss-security/2016/01/25/13
- [advisory] http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- [other] http://www.securityfocus.com/bid/81801
- [other] http://www.securitytracker.com/id/1034816
- [advisory] http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
- [other] https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
- [advisory] http://www.debian.org/security/2016/dsa-3464
- [advisory] http://rhn.redhat.com/errata/RHSA-2016-0296.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.