---
gem: actionpack
framework: rails
cve: 2014-7818
url: https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo
title: Arbitrary file existence disclosure in Action Pack
date: 2014-10-30

description: |
  Specially crafted requests can be used to determine whether a file exists on
  the filesystem that is outside the Rails application's root directory.  The
  files will not be served, but attackers can determine whether or not the file
  exists.

cvss_v2: 4.3

unaffected_versions:
  - "< 3.0.0"

patched_versions:
  - ~> 3.2.20
  - ~> 4.0.11
  - ~> 4.1.7
  - ">= 4.2.0.beta3"