Mail Gem Path Traversal vulnerability (GHSA-cj92-c4fj-w9c5)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2012-2139
Severity: MODERATE · CWE: CWE-22

Directory traversal vulnerability in `lib/mail/network/delivery_methods/file_delivery.rb` in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a `..` (dot dot) in the to parameter.

Affected packages:
package: ecosystem: RubyGems
name: mail
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.4