CVE-2011-0449: actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitiv...

Security readout for executives and security teams

This old Rails flaw can let a remote user bypass intended access restrictions by changing the letter case of an action name. The issue only applies to Ruby on Rails 3.0.x before 3.0.4 when the application runs on a case-insensitive filesystem. Exposure is most likely in legacy Ruby on Rails 3.0.x applications before 3.0.4 running on a case-insensitive filesystem. Systems on supported Rails versions, or not relying on this affected resolver behavior, are less likely to be exposed. Prioritize this for legacy Rails estate review, not emergency response, unless affected Rails 3.0.x systems remain internet-facing. The business risk is unauthorized access bypass in old applications under specific filesystem conditions. Mitigation focus: Upgrade affected Rails 3.0.x applications to Rails 3.0.4 or later.; Review the Rails security advisory and vendor package guidance before changing production systems.; Identify whether any affected application runs on a case-insensitive filesystem..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.