CVE-2014-0130 — Vulnerability in actionpack — CVE Details

HIGH

Actively Exploited

actionpack Path Traversal vulnerability

Published October 24, 2017Updated October 24, 2025Source: osv

What Should I Do?

Patch Immediately

This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.

Summary

Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Advisory Timeline

First published October 24, 2017 (3275 days ago).
Last revised October 24, 2025 — 2922 days after initial publication.
Added to CISA's Known Exploited Vulnerabilities catalog 1612 days after publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update actionpack to 4.1.1 or later

gem install actionpack -v 4.1.1

Bundler

Update actionpack to 4.0.5 or later

gem install actionpack -v 4.0.5

Bundler

Update actionpack to 3.2.18 or later

gem install actionpack -v 3.2.18

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: rubygems (1).

Package	Ecosystem	Affected	Fixed In
actionpack	rubygems	4.1.0	4.1.1
actionpack	rubygems	4.0.0, 4.0.1, 4.0.1.rc1, 4.0.1.rc2 (+6 more)	4.0.5
actionpack	rubygems	3.0.0, 3.0.1, 3.0.10, 3.0.10.rc1 (+98 more)	3.2.18

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-22
Path TraversalMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H

References

Frequently Asked Questions

What is CVE-2014-0130?: actionpack Path Traversal vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2014-0130?: CVE-2014-0130 affects actionpack. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2014-0130 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Known Exploited Vulnerability

This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Added to KEV catalog: March 25, 2022

Remediation deadline: April 15, 2022

Also Known As

GHSA-6x85-j5j2-27jx

Related CVEs

CVE-2016-2098
HIGH
actionpack allows remote code execution via application's unrestricted use of render method
CVE-2021-22904
HIGH
Possible DoS Vulnerability in Action Controller Token Authentication
CVE-2020-8164
HIGH
Possible Strong Parameters Bypass in ActionPack
CVE-2022-23633
HIGH
Exposure of information in Action Pack
CVE-2016-0752
HIGH
Directory traversal vulnerability in Action View in Ruby on Rails
CVE-2021-22903
MEDIUM
Possible Open Redirect Vulnerability in Action Pack
CVE-2023-22797
MEDIUM
Open Redirect Vulnerability in Action Pack
CVE-2024-41128
MEDIUM
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies