Ruby on Rails Directory Traversal Vulnerability (CVE-2016-0752)

What is affected, what to do

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

The vulnerability is being actively exploited; treat it as a priority. Update Ruby on Rails Rails to version 3.2.22.1, Ruby on Rails Rails to version 4.1.14.1, Ruby on Rails Rails to version 4.2.5.1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Ruby on Rails Rails lt *..3.2.22.1
• Ruby on Rails Rails lt 4.0.0..4.1.14.1
• Ruby on Rails Rails lt 4.2.0..4.2.5.1
• Ruby on Rails Rails eq 5.0.0..5.0.0
• openSUSE Leap eq 42.1..42.1
• OpenSUSE eq 13.2..13.2
• SUSE Linux Enterprise Module For Containers eq 12..12
• Debian Linux eq 8.0..8.0
• Red Hat Software Collections eq 1.0..1.0

Fixed in

• Ruby on Rails Rails 3.2.22.1
• Ruby on Rails Rails 4.1.14.1
• Ruby on Rails Rails 4.2.5.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory Rails versions across all applications (bundle list | grep rails, Gemfile.lock, container images). Upgrade to patched releases: 3.2.22.1, 4.1.14.1, 4.2.5.1, or 5.0.0.beta1.1. For Red Hat Software Collections, apply the matching rh-ror42 update via yum update; Debian 8 (jessie) via apt-get install ruby-actionview; openSUSE 13.2 / Leap 42.1 via zypper patch.
   • Perform a code audit for render params[:...], render file:, and render template: with user-controlled path input. Any controller passing user input straight into render is acutely vulnerable — until patched, disable the affected routes or rewrite them to static template mapping (render "static/name").
   • Add an immediate block rule to any reverse proxy fronting the Rails apps (nginx, Apache, HAProxy): reject requests containing .., %2e%2e, ..%2f, %252e, or URL-encoded null bytes in path or query with HTTP 400.
   • Grep the last 90 days of web access logs for traversal patterns (grep -E "(\.\.|%2e%2e|%252e)" access.log). On any hit, open an incident; treat reads of /etc/passwd, database.yml, secrets.yml, master.key, or /proc/self/environ as confirmed compromise and rotate secrets (DB credentials, Rails secret_key_base, API keys, SSH keys owned by the app user).
   • For legacy apps that cannot be patched (end-of-life Rails 3.x/4.x without support contract), place them behind VPN or at minimum behind mTLS/IP allow-listing until modernised.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF rule (ModSecurity, AWS WAF, Cloudflare): inspect request URI and decoded query string against (\.\.(/|\\|%2f|%5c))|%252e%252e and block; alert on all 4xx/5xx hits against render-style paths.
   • Reverse-proxy hardening: nginx location with if ($request_uri ~* "\.\.") { return 400; }, Apache RedirectMatch 400 "\.\.". Enable path normalisation (merge_slashes on;).
   • Network and filesystem segmentation: Rails app servers should only read the app directory and /tmp — AppArmor/SELinux profile that denies reads on /etc/shadow, /root, /home/*/.ssh, /var/lib/*/private. Run the Rails process as an unprivileged user (not root, no sudoable deploy user).
   • Move secrets off the app filesystem: migrate database.yml, secrets.yml, and master.key into Vault, AWS Secrets Manager, or Azure Key Vault, injected via ENV, so a file-read leak does not expose credentials.
   • IPS signature (Suricata/Snort): log HTTP GET/POST with ../ in the URI-decoded payload and drop them when destined for Rails backends; Zeek http.log policy flagging uri with the traversal regex.
   • Egress filtering on app servers: outbound traffic restricted to known backends (DB, cache, SMTP). Prevents exfiltration if a secret read succeeded.
3. 03

   Runbook step 3

   Detection rules

   • Web access-log search (Splunk/Elastic): index=web sourcetype=nginx OR sourcetype=apache uri_path IN ("*..*", "*%2e%2e*", "*%252e*") — any hit on a Rails vhost is an alert.
   • Sigma shape:

     detection:
       selection:
         cs-uri-stem|contains:
           - '../'
           - '..%2f'
           - '%2e%2e/'
           - '%252e%252e'
       condition: selection
     

   • auditd on app servers: -w /etc/passwd -p r -k rails_sensitive_read plus -w /var/www/*/config/secrets.yml -p r -k rails_secret_read. Alert when the Rails process (comm=ruby, puma, unicorn) is the reader and the path lies outside the app directory.
   • EDR process tree: a Rails worker spawning cat, less, find, or curl — Rails apps should not normally invoke shells. An ancestry like puma -> sh -> cat /etc/passwd is a strong exploitation signal.
   • KQL (Azure Sentinel) for Rails logs:

     W3CIISLog | where csUriStem contains ".." or csUriQuery contains "%2e%2e" | summarize count() by cIP, csUriStem
     

   • Response-size anomaly: GET requests on routes that normally return HTML suddenly answering with text/plain or unusual response size (>50 kB) — likely config or key file disclosure.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Source: NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Debian Debian Linux
• openSUSE openSUSE Leap
• openSUSE OpenSUSE
• Red Hat Red Hat Software Collections
• Rubyonrails Ruby on Rails Rails
• SUSE

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

References & sources

• NVD (NIST)vuln/detail/CVE-2016-0752advisory
• GitHub Security Advisoriesadvisories/GHSA-xrr4-p6fq-hjg7advisory
• github.comrubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0…web
• github.comrubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-0…web
• groups.google.comforumweb
• groups.google.com[ruby-security-ann] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action Viewweb, Mailing list, x_refsource_MLIST, Broken link
• web.archive.orgweb/20210618005620/https://groups.google.com/forum/message/raw?…web
• web.archive.orgweb/20210621170450/http://www.securityfocus.com/bid/81801web
• web.archive.orgweb/20210723192420/http://www.securitytracker.com/id/1034816web
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752web, government-resource, US government resource
• exploit-db.comexploits/40561web
• lists.fedoraproject.orgFEDORA-2016-fa0dec2360web, Vendor advisory, x_refsource_FEDORA, Permissions required
• lists.fedoraproject.orgFEDORA-2016-97002ad37bweb, Vendor advisory, x_refsource_FEDORA, Permissions required
• lists.opensuse.orgSUSE-SU-2016:1146web, Vendor advisory, x_refsource_SUSE, Mailing list, Third-party advisory
• lists.opensuse.orgopenSUSE-SU-2016:0363web, Vendor advisory, x_refsource_SUSE, Mailing list, Third-party advisory
• lists.opensuse.orgopenSUSE-SU-2016:0372web, Vendor advisory, x_refsource_SUSE, Mailing list, Third-party advisory
• rhn.redhat.comRHSA-2016:0296web, Vendor advisory, x_refsource_REDHAT, Third-party advisory
• debian.orgDSA-3464web, Vendor advisory, x_refsource_DEBIAN, Mailing list, Third-party advisory
• openwall.com[oss-security] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action Viewweb, Mailing list, x_refsource_MLIST, Exploit, Mailing list
• securityfocus.com81801web, Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database