Skip to content
OpenAdvisories
High USN-8990-1 1 CVE

ruby-sprockets vulnerability

Published Nov 3, 2026 · Updated Nov 4, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Sprockets incorrectly handled certain specially
crafted requests when the Sprockets server was used in production. A remote
attacker could possibly use this issue to access files outside of the
application's root directory.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby-sprockets 3.3.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2018-3760 Public exploit Scanner template EPSS 26%

    Sprockets path traversal leads to information leak

    There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root di…

    HackerOne Sprockets sprockets ruby-sprockets Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2018-3760