Sinatra Path Traversal vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-7212 · ADVISORY
• sinatra/sinatra#1379 · WEB
• sinatra/sinatra commit 6ad721a · WEB
• sinatra/sinatra · PACKAGE

Autres vulnérabilités de sinatra

• CVE-2025-61921ÉLEVÉE 7.5Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulner…
• CVE-2024-21510MOYENNE 5.4Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (X…
• CVE-2022-45442ÉLEVÉE 8.8Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 bef…
• CVE-2022-29970ÉLEVÉE 7.5Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
• CVE-2018-11627MOYENNE 6.1Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.