CVE-2013-4413

The Wicked gem for Ruby is affected by a directory traversal in controller/concerns/render_redirect.rb before version 1.0.1, where an attacker can read arbitrary files by sending a URL with encoded "../" sequences (via the_step parameter). Impact is reading arbitrary files; no exploitation detail...