CVE-2014-0130

HIGH KEV

Ruby on Rails <3.2.18, <4.0.5, <4.1.1 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2014-0130 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2022. EIP tracks 1 public exploit from researchers including omarkurt.

AI-analyzed exploit summary The repository appears to be a basic Rails application skeleton without any exploit code or proof-of-concept for CVE-2014-0130. No offensive techniques or vulnerability demonstrations are present.

Description

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Exploits (1)

nomisec STUB 19 stars
by omarkurt · poc
https://github.com/omarkurt/cve-2014-0130

The repository appears to be a basic Rails application skeleton without any exploit code or proof-of-concept for CVE-2014-0130. No offensive techniques or vulnerability demonstrations are present.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Unknown (Rails application skeleton)
No auth needed
Prerequisites: None identified
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1863.html
Broken Link, Technical Description x_refsource_misc
http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
Broken Link, Third Party Advisory mailing-list x_refsource_mlist
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/67244

Scores

CVSS v3 7.5
EPSS 0.5271
EPSS Percentile 98.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-03-25
VulnCheck KEV 2022-01-12
InTheWild.io 2022-03-25
ENISA EUVD EUVD-2017-0180
CWE
CWE-22
Status published
Products (4)
redhat/enterprise_linux_server 6.0
redhat/subscription_asset_manager < 1.3.0
rubygems/actionpack 3.0.0 - 3.2.18RubyGems
rubyonrails/rails < 3.2.18
Published May 07, 2014
KEV Added Mar 25, 2022
Tracked Since Feb 18, 2026