CVE-2012-2139: Mail Path Traversal vulnerability in RubyGems Mail
Summary
CVE-2012-2139: Mail Gem Path Traversal vulnerability. Affects mail versions < 2.4.4. Fixed in 2.4.4. How to fix ↓
Also tracked for
- ruby-mail · Debian:11
The same CVE-2012-2139 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Mail gem is a Ruby library used for handling email messages. It provides functionality for creating, sending, and parsing email messages. The gem is widely used in Ruby applications for email-related tasks. However, versions before 2.4.4 are vulnerable to a directory traversal vulnerability in the lib/mail/network/delivery_methods/file_delivery.rb file. This vulnerability allows remote attackers to read arbitrary files by exploiting a '..' (dot dot) in the 'to' parameter of the email message.
Vulnerability Detail
The directory traversal vulnerability in the Mail gem allows an attacker to bypass file access restrictions and read arbitrary files on the system. By including '..' in the 'to' parameter of an email message, an attacker can traverse directories and access sensitive files outside the intended scope. This can lead to unauthorized disclosure of sensitive information, such as configuration files, user data, or other confidential data stored on the system. The impact of this vulnerability depends on the specific files that can be accessed and the sensitivity of the information contained within them.
How To Fix
Latest published version: 2.9.1 as of 23 Oct 2026
gem install mail -v 2.9.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.4
This is the first release that contains the fix.
gem install mail -v 2.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the Mail gem is not immediately feasible, a workaround can be implemented by validating and sanitizing user input before using it in the 'to' parameter of email messages. This can involve checking for the presence of '..' or other directory traversal characters and rejecting or sanitizing the input accordingly. Additionally, access controls and file permissions should be properly configured to limit the impact of any potential directory traversal attacks.
Conclusion
The Mail gem before version 2.4.4 for Ruby is vulnerable to a directory traversal vulnerability that allows remote attackers to read arbitrary files. To mitigate this vulnerability, it is recommended to upgrade to version 2.4.4 or later of the Mail gem. If immediate upgrading is not possible, implementing input validation and sanitization can help reduce the risk. Proper access controls and file permissions should also be in place. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mail →
FAQ
The vulnerability allows remote attackers to read arbitrary files on the system, potentially leading to unauthorized disclosure of sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this Mail gem vulnerability.
Yes, upgrading to version 2.4.4 or later of the Mail gem fixes this vulnerability. It is recommended to update your application's dependencies to use the latest version of the gem.
If immediate upgrading is not possible, you can implement input validation and sanitization to mitigate the risk of directory traversal attacks. Additionally, ensure proper access controls and file permissions are in place.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-cj92-c4fj-w9c5/GHSA-cj92-c4fj-w9c5.json
Related vulnerabilities
Recent vulnerabilities recorded for mail.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
