CVE-2019-11879

5.5 mediumEPSS 0.5%

Medium (5.5) in ruby-lang webrick. EPSS 0.5% chance of exploitation in the next 30 days.

The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem.

Severity

CVSS 3.0

5.5 medium

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-59
Published: 2019-05-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ruby-lang:webrick

References

https://bugs.ruby-lang.org/issues/15835
https://bugs.ruby-lang.org/issues/15835

Check your stack JSON