CVE-2020-8162

HIGH

Rails <5.2.4.2, <6.0.3.1 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-8162. PoCs published by usutani.

AI-analyzed exploit summary This repository appears to be a stub or study project for Turbolinks, lacking exploit code or PoC for CVE-2024-26144. It contains a basic Rails application structure with Turbolinks integration but no offensive techniques.

Description

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

Exploits (1)

nomisec STUB
by usutani · poc
https://github.com/usutani/study-turbolinks-link

This repository appears to be a stub or study project for Turbolinks, lacking exploit code or PoC for CVE-2024-26144. It contains a basic Rails application structure with Turbolinks integration but no offensive techniques.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Turbolinks (version unspecified)
No auth needed
Prerequisites: None identified
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/789579
Mailing List, Patch, Third Party Advisory x_refsource_misc
https://groups.google.com/g/rubyonrails-security/c/PjU3946mreQ
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4766

Scores

CVSS v3 7.5
EPSS 0.0155
EPSS Percentile 81.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-434 CWE-602
Status published
Products (3)
debian/debian_linux 10.0
rubygems/activestorage 5.0.0 - 5.2.4.3RubyGems
rubyonrails/rails < 5.2.4.2
Published Jun 19, 2020
Tracked Since Feb 18, 2026