CVE-2018-3760

CVE-2018-3760 is a Local File Inclusion/path-traversal vulnerability in Ruby on Rails’ Sprockets, caused by a flaw in the server-side routine forbidden_request?() that allowed access to files outside the application root when the Sprockets server is used in production. Affected versions include S...

CVE-2014-7819

CVE-2014-7819 affects Sprockets in Ruby on Rails 3.x/4.x, where server.rb exposes directory traversal via ../ sequences (including double slashes or URL-encoding), allowing remote attackers to infer existence of files outside the application root. Affected versions include 2.0.5–2.12.x (various 2...