CVE-2011-2929: Rubyonrails Rails

Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days.

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Affected products

• Rubyonrails Rails: version 3.0.0 only; version 3.0.1 only; version 3.0.2 only; version 3.0.3 only; version 3.0.4 only; version 3.0.5 only; …
• Rubyonrails Ruby On Rails: version 3.0.4 only

Published 2011-08-29. Last modified 2026-06-16.