CVE-2016-0752VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2016-0752: Ruby on Rails Directory Traversal Vulnerability

Affects Rails Ruby on RailsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 95.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-0752 (opens in a new tab)

Description

CVE-2016-0752 is a directory traversal vulnerability in the Action View component of Ruby on Rails. This flaw allows remote attackers to read arbitrary files on the affected system. The vulnerability has been exploited in the wild, indicating active use by attackers. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability in Ruby on Rails' Action View permits remote attackers to perform directory traversal attacks, enabling them to read arbitrary files. The issue is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Exploitation of this vulnerability has been observed in the wild, underscoring its practical risk. However, no explicit patch or remediation details are included in the provided information.

Impact

Successful exploitation allows remote attackers to read arbitrary files on the server running Ruby on Rails, potentially exposing sensitive information. This can lead to information disclosure and further compromise depending on the files accessed. The vulnerability has been actively exploited in the wild, confirming its real-world impact.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, restrict access to vulnerable systems and monitor for exploitation attempts. Avoid exposing vulnerable versions to untrusted networks.

Weaknesses

CWE-22Path Traversal (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:56:34 UTC

Weaknesses

References

Related threats