CVE-2014-7818

score

<0.1

cvss

4.3

epss

3.5%

published

2014-11-08

kev added

—

first seen

2026-10-21

Ruby on Rails Action Pack < 3.2.20, 4.0.x < 4.0.11, 4.1.x < 4.1.7, and 4.2.x < 4.2.0.beta3 contain a path traversal caused by improper handling of /..%2F sequences in static file serving, letting remote attackers determine the existence of files outside the application root, exploit requires serve_static_assets to be enabled.