Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

WEBrick in Ruby can let attackers read any file

CVE-2008-1145 · published 18 years ago
Summary

The WEBrick web server component included with Ruby versions before certain patches can be tricked into revealing files from the server’s file system. This happens on operating systems that use backslashes in paths or ignore case in file names, allowing outsiders to request files they shouldn’t see. Update Ruby to the latest version or apply the security patches that fix the path‑handling logic.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ruby-lang webrick All versions
cpe:2.3:a:ruby-lang:webrick:-:*:*:*:*:ruby:*:*
fedoraproject fedora 7
8
cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insens...
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
27% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published4 Mar 2008
Updated20 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-1145 · NVD
Track software like this
Free during beta