Moderate severityNVD Advisory· Published Oct 6, 2015· Updated May 6, 2026
CVE-2015-7314
CVE-2015-7314
Description
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
gollumRubyGems | < 4.0.1 | 4.0.1 |
Affected products
1Patches
11 file changed · +1 −0
lib/gollum/app.rb+1 −0 modified@@ -176,6 +176,7 @@ def wiki_new fullname = params[:file][:filename] tempfile = params[:file][:tempfile] end + halt 500 unless tempfile.is_a? Tempfile # Remove page file dir prefix from upload path if necessary -- committer handles this itself dir = wiki.per_page_uploads ? params[:upload_dest].match(/^(#{wiki.page_file_dir}\/+)?(.*)/)[2] : 'uploads'
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1nvdPatchWEB
- github.com/gollum/gollum/issues/1070nvdPatchVendor AdvisoryWEB
- jvn.jp/en/jp/JVN27548431/index.htmlnvdVendor AdvisoryWEB
- jvndb.jvn.jp/jvndb/JVNDB-2015-000149nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-m2q3-53fq-7h66ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2015-7314ghsaADVISORY
- www.openwall.com/lists/oss-security/2015/09/22/12nvdWEB
News mentions
0No linked articles in our index yet.