Critical USN-9058-1 1 CVE

ruby-actionpack-page-caching vulnerability

Published Nov 11, 2026 · Updated Nov 12, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Action Pack Page Caching incorrectly handled certain
request paths when writing cached pages. A remote attacker could possibly
use this issue to write arbitrary files to the web server, and possibly
execute arbitrary code.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	ruby-actionpack-page-caching	1.0.2-4ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	ruby-actionpack-page-caching	1.0.2-4ubuntu0.18.04.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS	ruby-actionpack-page-caching	1.1.0-1ubuntu0.1~esm1

Vulnerabilities 1

Critical 9.8

CVE-2020-8159

Arbitrary file write in actionpack-page_caching gem

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.

actionpack-page_caching ruby-actionpack-page-caching ruby-actionpack-page-caching Debian Ubuntu RubyGems

May 12, 2020

References

report
https://ubuntu.com/security/CVE-2020-8159