Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nwqq-fdtk-dudg
Vulnerability ID VCID-nwqq-fdtk-dudg
Aliases CVE-2018-7212
GHSA-h29f-7f56-j8wh
Summary Path traversal on Windows Path traversal is possible via backslash characters on Windows. An attacker could access arbitrary files and directories stored on the file system.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-7212.json
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2018-7212
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-h29f-7f56-j8wh
cvssv3.1 5.3 https://github.com/sinatra/sinatra
generic_textual MODERATE https://github.com/sinatra/sinatra
cvssv3.1 5.3 https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c
generic_textual MODERATE https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c
cvssv3 5.3 https://github.com/sinatra/sinatra/pull/1379
cvssv3.1 5.3 https://github.com/sinatra/sinatra/pull/1379
generic_textual MODERATE https://github.com/sinatra/sinatra/pull/1379
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2018-7212
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2018-7212
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-7212.json
https://api.first.org/data/v1/epss?cve=CVE-2018-7212
https://github.com/sinatra/rack-protection/pull/120
https://github.com/sinatra/rack-protection/pull/120/commits/4239c2f189a73dfc93e957fc97adcbcbc0ed31c6
https://github.com/sinatra/sinatra
https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c
https://github.com/sinatra/sinatra/commit/d17aa95f5056c52daf5d7c3170fbfd831dc96381
https://github.com/sinatra/sinatra/pull/1379
1802282 https://bugzilla.redhat.com/show_bug.cgi?id=1802282
CVE-2018-7212 https://nvd.nist.gov/vuln/detail/CVE-2018-7212
GHSA-h29f-7f56-j8wh https://github.com/advisories/GHSA-h29f-7f56-j8wh
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-7212.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/sinatra/sinatra
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/sinatra/sinatra/pull/1379
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-7212
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.51175
EPSS Score 0.00278
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:47:35.398960+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rack-protection/CVE-2018-7212.yml 38.0.0