Read the docs
TI-2007-06308 Aliases CVE-2007-6612GHSA-m7r6-43v2-49vf

Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel…

Priority LOW 34CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").

Why it matters now

EPSS 0.03003 87th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed mongrel (RubyGems): 1.0.5, 1.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—mongrel (RubyGems)1.0.4 to before 1.0.51.0.5Patch availableGHSA-m7r6-43v2-49vf
—mongrel (RubyGems)1.1.0 to before 1.1.31.1.3Patch availableGHSA-m7r6-43v2-49vf
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • mongrel (RubyGems) Vendor— Affected 1.0.4 to before 1.0.5 Fixed in 1.0.5 Patch available GHSA-m7r6-43v2-49vf
  • mongrel (RubyGems) Vendor— Affected 1.1.0 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-m7r6-43v2-49vf

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mongrel:mongrel:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableMongrel
cpe:2.3:a:mongrel:mongrel:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableMongrel
cpe:2.3:a:mongrel:mongrel:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableMongrel
  • cpe:2.3:a:mongrel:mongrel:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Mongrel
  • cpe:2.3:a:mongrel:mongrel:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Mongrel
  • cpe:2.3:a:mongrel:mongrel:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Mongrel

Remediation

  • Fix · GHSA-m7r6-43v2-49vf mongrel (RubyGems) Fixed in 1.0.5 Advisory →
  • Fix · GHSA-m7r6-43v2-49vf mongrel (RubyGems) Fixed in 1.1.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-6612
  2. 2026-10-03 Alias added: GHSA-m7r6-43v2-49vf

References

Exploit 2

Advisory 3

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences