Rails

Vulnerability activity for Rails: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 10
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 10
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 10
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

7.5HighMar 27, 2019Ruby on Rails Path traversal / file handlingCVE-2019-5418Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.Added to KEV Jul 7, 2025 · 2,293 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
7.5HighFeb 16, 2016Ruby on Rails Path traversal / file handlingCVE-2016-0752Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.Added to KEV Mar 25, 2022 · 2,229 days after publicationExploited96% likelyExploit codeExploit-DB · Metasploit
7.5HighMay 7, 2014Ruby on Rails Path traversal / file handlingCVE-2014-0130Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.Added to KEV Mar 25, 2022 · 2,879 days after publicationExploited54% likelyExploit code

Recent

3.7LowNov 11, 2026rails Information disclosureCVE-2026-126188Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/* or audio/* content type for an HLS playlist. FFmpeg content p
4.7MediumNov 10, 2026rails Auth bypass / access controlCVE-2026-126084Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cache_control option, ActiveStorage::Service::GCSService#url_for_direct_upload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, witho
9.8CriticalNov 10, 2026rails Path traversal / file handlingCVE-2026-126082Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, a Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include secret_key_base and credentials for external systems,
7.5HighNov 10, 2026railsCVE-2026-126081Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. A
6.1MediumNov 10, 2026rails XSSCVE-2026-126079Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight split
6.1MediumNov 10, 2026rails XSSCVE-2026-126078Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the <a href="search?q=\1"> form shown in the m
6.8MediumNov 10, 2026rails Information disclosureCVE-2026-126077Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to keep the se
5.9MediumNov 10, 2026railsCVE-2026-126072Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread
6.1MediumNov 10, 2026rails XSSCVE-2026-126070Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes,
4.7MediumNov 10, 2026rails XSSCVE-2026-126069Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, the fix for CVE-2026-33168 skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as :" ", is not blank, because Symbol#blank? is Symbol#empty?, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed
7.5HighMar 27, 2019Ruby on Rails Path traversal / file handlingCVE-2019-5418Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
7.5HighFeb 16, 2016Ruby on Rails Path traversal / file handlingCVE-2016-0752Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.Exploited96% likelyExploit codeExploit-DB · Metasploit
7.5HighMay 7, 2014Ruby on Rails Path traversal / file handlingCVE-2014-0130Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.Exploited54% likelyExploit code

See every Rails entry on the dashboard.