Back to Security Advisories

Sprockets Vulnerability — Ubuntu Security Update (USN-8990-1)

USN-8990-1 fixes CVE-2018-3760 in Sprockets on Ubuntu — path traversal (CWE-22) when the Sprockets server mode ran in production, letting a remote attacker read arbitrary files outside the intended asset directory. Update: sudo apt update && sudo apt upgrade ruby-sprockets and restart the application. CVSS 7.5.

High 7.5 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Path traversal in an asset server reads arbitrary files as the application user — source code, configuration files with secrets, and environment files are all readable targets.

  1. Ubuntu Security Notices

  2. USN-8990-1

Publication date

3 November 2026

Overview

Sprockets would allow unintended access to files over the network.

Releases


16.04 LTS

Open side navigation

Packages

Details

It was discovered that Sprockets incorrectly handled certain specially
crafted requests when the Sprockets server was used in production. A remote
attacker could possibly use this issue to access files outside of the
application’s root directory.

It was discovered that Sprockets incorrectly handled certain specially
crafted requests when the Sprockets server was used in production. A remote
attacker could possibly use this issue to access files outside of the
application’s root directory.

Update instructions

After a standard system update you need to restart any applications using
Sprockets to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04

LTS xenial

 ruby-sprockets – 

3.3.0-1ubuntu0.1~esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Frequently Asked Questions

What is CVE-2018-3760?
It is a path traversal vulnerability (CWE-22) in Sprockets — the Ruby asset pipeline — when its server mode ran in production: crafted requests could read files outside the asset directory. CVSS 7.5; fixed in USN-8990-1 (an old CVE backported to Ubuntu's packaged version).
Who is affected?
Ubuntu systems with the packaged ruby-sprockets running Rails or Rack applications in production with Sprockets server mode enabled — older Ruby stacks are the typical case.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade ruby-sprockets and restart the application. Verify no requests for crafted asset paths appear in access logs before the fix window.
Why is a 2018 CVE appearing now?
Ubuntu backports fixes into its packaged library versions on its own schedule — old CVEs arrive when the backport window opens. The practical instruction is unchanged: apply the current update.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System