Measured is vulnerable to Path Traversal attacks during class initialization

published 2025-07-15 last yr. modified 2025-07-15 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the `Measured::Cache::Json class` would be able to instruct the library to read arbitrary files.

### Patches Users should update to the latest version.

Patch / fix

fixed in 1 links 1

rubygems measured 3.2.1

github.com/Shopify/measured@d631998 commit

Is GHSA-29g5-m8v7-v564 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
rubygems	measured	<3.2.1	3.2.1

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

GitHub Advisory GHSA-29g5-m8v7-v564

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.