CVE-2018-7212
Description
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Path traversal vulnerability in Sinatra 2.x before 2.0.1 on Windows allows reading arbitrary files via backslash characters.
Vulnerability
Sinatra versions 2.x prior to 2.0.1 on Windows operating systems are vulnerable to path traversal attacks due to improper validation of backslash characters in file paths [2]. The vulnerability is located in the rack-protection/lib/rack/protection/path_traversal.rb file [2]. An attacker can use backslashes (\\) to bypass the path traversal protection and access files outside the intended directory.
Exploitation
An attacker does not require authentication but needs to be able to send HTTP requests to a Sinatra application. By crafting a URL with backslash characters (e.g., ..\), the attacker can traverse directories and read arbitrary files on the Windows filesystem. No user interaction is required [2].
Impact
Successful exploitation allows an attacker to read arbitrary files from the server's filesystem, potentially exposing sensitive information such as configuration files, source code, or other data. The attack occurs at the application's privilege level [2].
Mitigation
The vulnerability is fixed in Sinatra version 2.0.1, released on 2018-02-12 [3]. Users should upgrade to Sinatra 2.0.1 or later. The fix involved enhanced path validation for Windows, implemented in pull request #1379 [4]. As a workaround, users on Windows could restrict file access via other means, but upgrading is strongly recommended. There is no evidence this CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sinatraRubyGems | >= 2.0.0.beta1, < 2.0.1 | 2.0.1 |
Affected products
1Patches
16ad721abcfe3Merge pull request #1387 from namusyaka/update-changelog
2 files changed · +17 −1
CHANGELOG.md+16 −0 modified@@ -1,3 +1,19 @@ +## 2.0.1 / 2018-02-12 + +* Repair nested namespaces, by avoiding prefix duplication #1322. Fixes #1310 by Kunpei Sakai + +* Add pattern matches to values for Mustermann::Concat #1333. Fixes #1332 by Dawa Ometto + +* Ship the VERSION file with the gem, to allow local unpacking #1338 by Olle Jonsson + +* Fix issue with custom error handler on bad request #1351. Fixes #1350 by Jordan Owens + +* Override Rack::ShowExceptions#pretty to set custom template #1377. Fixes #1376 by Jordan Owens + +* Enhanced path validation in Windows #1379 by Orange Tsai + +* Improve development support and documentation by Faheel Ahmad, Shota Iguchi, Olle Jonsson, Manabu Niseki, John Hope, Horacio, Ice-Storm, GraniteRock, Raman Skaskevich, Carlos Azuaje, 284km, Dan Rice and Zachary Scott + ## 2.0.0 / 2017-04-10 * Use Mustermann for patterns #1086 by Konstantin Haase
VERSION+1 −1 modified@@ -1 +1 @@ -2.0.0 +2.0.1.rc1
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-h29f-7f56-j8whghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-7212ghsaADVISORY
- github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9cghsax_refsource_MISCWEB
- github.com/sinatra/sinatra/pull/1379ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.