-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from rswag-api's file-serving logic that accepts user-controlled path parameters and resolves them against the Swagger root directory without proper path traversal checks. The Controller#get action and Middleware#call functions are core components handling these requests. The GitHub issue explicitly mentions the middleware's unsafe path resolution, and the CWE-22 classification confirms this is a path traversal flaw. Though exact code isn't shown, the pattern matches common Ruby file-serving vulnerabilities where user input isn't sanitized before file system operations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rswag | rubygems | < 2.10.1 | 2.10.1 |