CVE-2014-0130

Ruby on Rails directory traversal flaw allowed attackers to read arbitrary files via crafted requests.

A directory traversal vulnerability in Ruby on Rails' implicit-render implementation enabled remote attackers to read arbitrary files on affected systems. DIB organizations must ensure their Ruby on Rails applications are patched to prevent information disclosure and potential lateral movement. This failure highlights the risk of relying on unpatched, widely-used frameworks without rigorous supply-chain validation.

Shame score — A known directory traversal vulnerability in a widely-used framework was actively exploited in the wild, indicating a failure to patch critical flaws in time.