Description
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ruby +8 | 1.8.5-5.el5_2.5 | RHSA-2008:0897 |
| RHEL 4 | irb +6 | 1.8.1-7.el4_7.1 | RHSA-2008:0897 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ruby3.3-webrick | 1.9.1-r0 | — |
| Wolfi rolling | ruby3.4-webrick | 1.9.1-r3 | — |
| Wolfi rolling | ruby4.0-webrick | 1.9.2-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Ruby 1.8.6/1.9 (WEBick HTTPd 1.3.1) - Directory Traversal EDB-5215 · remote · Mar 6, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2008:0897 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- SUSE-SR:2008:017 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0123
- http://support.apple.com/kb/HT2163
- 29357 third-party-advisory
- 20080325 rPSA-2008-0123-1 ruby mailing-list
- VU#404515 third-party-advisory
- 28123 vdb-entry
- MDVSA-2008:141 vendor-advisory
- 20080306 [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file Download Vulnerability mailing-list
- ADV-2008-1981 vdb-entry
- 5215 exploit
- 29232 third-party-advisory
- ruby-webrick-directory-traversal(41010) vdb-entry
- 31687 third-party-advisory
- 20080306 Re: [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file Download Vulnerability mailing-list
- FEDORA-2008-2458 vendor-advisory
- RHSA-2008:0897 vendor-advisory
- APPLE-SA-2008-06-30 vendor-advisory
- http://www.ruby-lang.org/en/news/2008/03/03/webrick-file-access-vulnerability/
- ADV-2008-0787 vdb-entry
- 30802 third-party-advisory
- oval:org.mitre.oval:def:10937 vdb-entry signature
- 1019562 vdb-entry
- https://issues.rpath.com/browse/RPL-2338
- 32371 third-party-advisory
- MDVSA-2008:142 vendor-advisory
- 29536 third-party-advisory
- FEDORA-2008-2443 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0123