CVE-2014-0130VulnerabilityPublished 03/25/2022Updated 10/24/2026
CVE-2014-0130: Ruby on Rails Directory Traversal Vulnerability
Affects Rails Ruby on RailsSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 03/25/2022
- KEV deadline
- 04/15/2022
- EPSS
- 53.7% chance of exploitation in 30 days – higher than 98% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2014-0130 is a directory traversal vulnerability in Ruby on Rails affecting the implicit-render implementation in actionpack/lib/abstract_controller/base.rb. This flaw allows remote attackers to read arbitrary files on the affected system via crafted requests. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.