---
title: "Rails Asset Pipeline Directory Traversal Vulnerability (CVE-2018-3760)"
description: "All previously released versions of Sprockets, which powers the Rails asset pipeline, contained a directory traversal vulnerability, CVE-2018-3760. Rails applications were vulnerable when production runtime asset compilation was enabled with config.assets.compile = true; the default production setting was false, so apps using the default were not vulnerable. Sprockets handled requests by searching for rendered assets and compiling matches dynamically, and an attacker could exploit that process with a crafted URL based on a known absolute source-asset path to make it appear inside a permitted path. Patches were prepared for Sprockets versions 2, 3, and 4, with remediation via disabling runtime compilation or upgrading to versions 2.12.5, 3.7.2, or 4.0.0.beta8. Heroku also updated its Ruby Buildpack to fail affected builds, notified customers, and warned that compromised applications may require credential rotation."
---

# Rails Asset Pipeline Directory Traversal Vulnerability (CVE-2018-3760)

[Heroku](https://yomu.fyi/company/heroku) · Richard Schneeman · Jun 19, 2018

**Type:** Incident / postmortem

## Summary

All previously released versions of Sprockets, which powers the Rails asset pipeline, contained a directory traversal vulnerability, CVE-2018-3760. Rails applications were vulnerable when production runtime asset compilation was enabled with config.assets.compile = true; the default production setting was false, so apps using the default were not vulnerable. Sprockets handled requests by searching for rendered assets and compiling matches dynamically, and an attacker could exploit that process with a crafted URL based on a known absolute source-asset path to make it appear inside a permitted path. Patches were prepared for Sprockets versions 2, 3, and 4, with remediation via disabling runtime compilation or upgrading to versions 2.12.5, 3.7.2, or 4.0.0.beta8. Heroku also updated its Ruby Buildpack to fail affected builds, notified customers, and warned that compromised applications may require credential rotation.

## Context

Sprockets contained a directory traversal vulnerability affecting Rails applications that enabled runtime asset compilation in production. If an application was targeted, secrets in its repository or environment variables may have been compromised.

## Approach / What changed

The remediation was to disable config.assets.compile or upgrade Sprockets to a patched release. Patches covered Sprockets versions 2, 3, and 4; Heroku also updated the Ruby Buildpack to fail builds using runtime asset compilation with affected Sprockets versions and contacted potentially affected customers.

## Takeaways

- Applications with config.assets.compile = true in production were vulnerable; Rails production environments defaulted this setting to false.
- Sprockets versions 2.12.5, 3.7.2, and 4.0.0.beta8 were identified as patched release targets.
- A targeted application may have exposed repository secrets or environment variables, prompting precautionary rotation of database and other credentials.

**Tags:** [Ruby on Rails](https://yomu.fyi/topic/ruby-on-rails), [Security](https://yomu.fyi/topic/security), [Sprockets](https://yomu.fyi/topic/sprockets)

- Source: [Heroku](https://www.heroku.com/blog/rails-asset-pipeline-vulnerability)
- Source URL: https://www.heroku.com/blog/rails-asset-pipeline-vulnerability
- Ingested by Yomu: 2026-09-09T14:26:40.479Z

[Read original post](https://www.heroku.com/blog/rails-asset-pipeline-vulnerability)