CVE-2016-0752

CVE-2016-0752 is a directory traversal flaw (CWE-22) in the Action View component of the Ruby on Rails web framework. When a Rails application uses the render method with user-controlled, unrestricted input, a remote unauthenticated attacker can include '..' (dot-dot) sequences in a pathname, causing Rails to render files from outside the intended directory. Successful exploitation yields arbitrary file read on the server, potentially exposing application configuration files, secrets, and credentials; integrity and availability are not impacted per the CVSS vector. It affects Rails before 3.2.22.1, 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1, as well as Rails packages shipped by openSUSE, SUSE, Debian, and Red Hat. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), confirming exploitation in the wild, and EPSS assigns a 95.5% probability of exploitation within 30 days.

What to do: Upgrade Rails to 3.2.22.1, 4.1.14.1, 4.2.5.1, or 5.0.0.beta1.1 (or later), and apply the corresponding vendor updates for openSUSE/SUSE, Debian, and Red Hat Software Collections. Audit application code for calls to render (especially render file:) that pass user-controlled input, and validate or whitelist rendered paths to block traversal sequences. Prioritize internet-facing Rails applications given the CISA KEV listing.