rubygem-sprockets before versions 2.12.5, 3.7.2 and 4.0.0beta8 are vulnerable to a path traversal flaw in the sprockets/server.rb:forbiddenrequest?() function. A remote attacker could exploit this to read arbitrary files from the Sprockets server.

External References:

http://www.openwall.com/lists/oss-security/2018/06/19/2 https://blog.heroku.com/rails-asset-pipeline-vulnerability

Upstream Patch:

https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5f