Skip to content
Fencer Intel
high 7.5

CVE-2018-3760 in the critical feed json

Sprockets path traversal leads to information leak

published 2018-06-20 8 y ago modified 2026-06-17 4 mo ago also GHSA-pr3h-jjhj-573x , EUVD-2018-0198

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
26.3%
EPSS 26.3% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Patch / fix

  • rubygems sprockets 2.12.5, 3.7.2, 4.0.0.beta8
  • ruby-sprockets Debian 14, Debian 13, Debian 12 3.7.0-1.1

debian advisories DEBIAN-CVE-2018-3760

  • ruby-sprockets Ubuntu 18.04 LTS 3.7.0-1+deb9u1build0.18.04.1
  • ruby-sprockets Ubuntu Pro 16.04 LTS 3.3.0-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2018-3760

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cfme cloudforms managementengine 5.9 5.9.4.7-1.el7cf
  • cfme-gemset cloudforms managementengine 5.9 5.9.4.7-1.el7cf
  • cfme-appliance cloudforms managementengine 5.9 5.9.4.7-1.el7cf
  • cfme-appliance-tools cloudforms managementengine 5.9 5.9.4.7-1.el7cf
  • cfme-appliance-common cloudforms managementengine 5.9 5.9.4.7-1.el7cf
  • cfme-amazon-smartstate cloudforms managementengine 5.9 5.9.4.7-1.el7cf
  • rh-postgresql95-postgresql-pglogical cloudforms managementengine 5.9 2.1.0-4.el7cf
  • rh-ruby23-rubygem-redhat_access_cfme cloudforms managementengine 5.9 2.0.3-1.el7cf

red hat advisories RHSA-2018:2561RHSA-2018:2745RHSA-2018:2244RHSA-2018:2245

  • crowbar-ui OpenStack Cloud Crowbar 8 1.2.0+git.1533844061.4ac8e723-3.3.1
  • crowbar OpenStack Cloud Crowbar 8 5.0+git.1528696845.81a7b5d0-3.3.1
  • crowbar-ha OpenStack Cloud Crowbar 8 5.0+git.1530177874.35b9099-3.3.1
  • crowbar-core OpenStack Cloud Crowbar 8 5.0+git.1533887407.6e9b0412d-3.8.2
  • crowbar-init OpenStack Cloud Crowbar 8 5.0+git.1520420379.d5bbb35-3.3.1
  • crowbar-openstack OpenStack Cloud Crowbar 8 5.0+git.1534167599.d325ef804-4.8.2
  • crowbar-ui OpenStack Cloud 7 1.1.0+git.1533844061.4ac8e723-4.3.1
  • crowbar OpenStack Cloud 7, Enterprise Storage 4 4.0+git.1528801103.f5708341-7.20.1

suse advisories SUSE-SU-2018:2762-1SUSE-SU-2018:2603-1SUSE-SU-2018:2217-1SUSE-SU-2018:2176-1SUSE-SU-2018:1994-1

  • rubygem-sprockets openSUSE Tumbleweed 4.2.1-1.9
  • rubygem-sprockets-3.7 openSUSE Tumbleweed 3.7.5-1.5
  • rubygem-sprockets openSUSE Tumbleweed 4.2.1-1.7
  • rubygem-sprockets-3.7 openSUSE Tumbleweed 3.7.5-1.3
  • rubygem-sprockets openSUSE Tumbleweed 4.2.1-1.5
  • rubygem-sprockets-3.7 openSUSE Tumbleweed 3.7.3-1.1
  • rubygem-sprockets openSUSE Tumbleweed 4.0.3-1.1
  • ruby3.2-rubygem-sprockets openSUSE Tumbleweed 4.1.1-1.6

opensuse advisories openSUSE-SU-2026:10364-1openSUSE-SU-2026:10365-1openSUSE-SU-2025:15127-1openSUSE-SU-2025:15128-1openSUSE-SU-2024:14177-1openSUSE-SU-2024:14075-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-3760 updated cvss 7.5

rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files

  • Red Hat Ceph Storage 1.3 ruby193-rubygem-sprockets Red Hat Subscription Asset Manager ruby193-rubygem-sprockets
    affected: workaround, no fix planned “Ensure config.assets.compile = false in production.rb.”
  • Red Hat CloudForms Management Engine 5.8 cfme 5.8.5.1-1.el7cf, cfme-gemset 5.8.5.1-1.el7cf, cfme-appliance 5.8.5.1-1.el7cf, ansible-tower-setup 3.1.8-1.el7at, ansible-tower-server 3.1.8-1.el7at, rh-postgresql95-postgresql-pglogical 1.2.1-2.el7cf
    fixed: vendor fix “Ensure config.assets.compile = false in production.rb.” RHSA-2018:2745
  • Red Hat CloudForms Management Engine 5.9 cfme 5.9.4.7-1.el7cf, cfme-gemset 5.9.4.7-1.el7cf, cfme-appliance 5.9.4.7-1.el7cf, cfme-appliance-tools 5.9.4.7-1.el7cf, cfme-appliance-common 5.9.4.7-1.el7cf, cfme-amazon-smartstate 5.9.4.7-1.el7cf, +2 more
    fixed: vendor fix “Ensure config.assets.compile = false in production.rb.” RHSA-2018:2561
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ror42-rubygem-sprockets 3.2.0-5.el6, rh-ror50-rubygem-sprockets 3.7.1-2.el6 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ror42-rubygem-sprockets 3.2.0-5.el7, rh-ror50-rubygem-sprockets 3.7.1-2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-ror42-rubygem-sprockets 3.2.0-5.el6, rh-ror50-rubygem-sprockets 3.7.1-2.el6 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-ror42-rubygem-sprockets 3.2.0-5.el7, rh-ror50-rubygem-sprockets 3.7.1-2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ror42-rubygem-sprockets 3.2.0-5.el7, rh-ror50-rubygem-sprockets 3.7.1-2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-ror42-rubygem-sprockets 3.2.0-5.el7, rh-ror50-rubygem-sprockets 3.7.1-2.el7
    +2 more products
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ror42-rubygem-sprockets 3.2.0-5.el6, rh-ror50-rubygem-sprockets 3.7.1-2.el6 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ror42-rubygem-sprockets 3.2.0-5.el7, rh-ror50-rubygem-sprockets 3.7.1-2.el7
    fixed: vendor fix “Ensure config.assets.compile = false in production.rb.” RHSA-2018:2244
  • Red Hat Satellite 6 ruby193-rubygem-sprockets
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

26.35% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
rubygems sprockets
>=3.0.0, <3.7.2
>=4.0.0.beta1, <4.0.0.beta8
<2.12.5
3.7.2
4.0.0.beta8
2.12.5

Affected products

  • HackerOne Sprockets

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.