CVE-2021-22885

score

<0.1

cvss

7.5

epss

4.1%

published

2021-05-27

kev added

—

first seen

2026-10-21

Action Pack >= 2.0.0 contains a possible information disclosure / unintended method execution caused by using `redirect_to` or `polymorphic_url` helper with untrusted user input, letting attackers potentially access sensitive information or execute unintended methods, exploit requires attacker to control user input.