{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Rails vulnerabilities","home_page_url":"https://patchfirst.co/vendor/rails/","feed_url":"https://patchfirst.co/feed/vendor/rails.json","description":"New and newly exploited Rails CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-66066","url":"https://patchfirst.co/cve/CVE-2026-66066/","title":"CVE-2026-66066: Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing","content_text":"rails · rails. Not in CISA KEV. EPSS 30.1% (higher than 98.2% of CVEs). CVSS 9.5 CRITICAL. Public exploit code exists. Priority 78.7 of 100.","summary":"Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing","date_published":"2026-07-30T00:00:00.000Z","date_modified":"2026-08-05T13:46:21.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":78.7,"kev":null,"epss":{"score":0.30071,"percentile":0.98209},"cvss":{"score":9.5,"severity":"CRITICAL","version":"4.0"},"vendor":"rails","product":"rails","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-5418#kev","url":"https://patchfirst.co/cve/CVE-2019-5418/","title":"[KEV] CVE-2019-5418: Rails Ruby on Rails Path Traversal Vulnerability","content_text":"Rails · Ruby on Rails. In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Rails Ruby on Rails Path Traversal Vulnerability","date_published":"2025-07-07T00:00:00.000Z","date_modified":"2026-06-17T02:37:39.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-07-07","ransomware":false},"epss":{"score":0.98507,"percentile":0.9992},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Rails","product":"Ruby on Rails","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-0752#kev","url":"https://patchfirst.co/cve/CVE-2016-0752/","title":"[KEV] CVE-2016-0752: Ruby on Rails Directory Traversal Vulnerability","content_text":"Rails · Ruby on Rails. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 95.5% (higher than 99.87% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Ruby on Rails Directory Traversal Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T00:38:09.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.95537,"percentile":0.99869},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Rails","product":"Ruby on Rails","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-0130#kev","url":"https://patchfirst.co/cve/CVE-2014-0130/","title":"[KEV] CVE-2014-0130: Ruby on Rails Directory Traversal Vulnerability","content_text":"Rails · Ruby on Rails. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 53.7% (higher than 99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.0 of 100.","summary":"Ruby on Rails Directory Traversal Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T00:02:21.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.53703,"percentile":0.98995},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Rails","product":"Ruby on Rails","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-5267","url":"https://patchfirst.co/cve/CVE-2020-5267/","title":"CVE-2020-5267: Possible XSS vulnerability in ActionView","content_text":"rails · actionview. Not in CISA KEV. EPSS 1.5% (higher than 74.6% of CVEs). CVSS 4.0 MEDIUM. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1185 Browser Session Hijacking. Priority 22.7 of 100.","summary":"Possible XSS vulnerability in ActionView","date_published":"2020-03-19T00:00:00.000Z","date_modified":"2024-08-04T08:22:09.000Z","tags":["public-exploit","T1059","T1185"],"_patchfirst":{"reason":"published","priority":22.7,"kev":null,"epss":{"score":0.01525,"percentile":0.74636},"cvss":{"score":4,"severity":"MEDIUM","version":"3.1"},"vendor":"rails","product":"actionview","techniqueIds":["T1059","T1185"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-5420","url":"https://patchfirst.co/cve/CVE-2019-5420/","title":"CVE-2019-5420: A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess…","content_text":"Rails · https://github.com/rails/rails. Not in CISA KEV. EPSS 89.3% (higher than 99.78% of CVEs). Public exploit code exists. Priority 25.6 of 100.","summary":"A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess…","date_published":"2019-03-27T00:00:00.000Z","date_modified":"2024-08-04T19:54:53.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":25.6,"kev":null,"epss":{"score":0.8933,"percentile":0.99782},"cvss":null,"vendor":"Rails","product":"https://github.com/rails/rails","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}