CVE-2013-4413: Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1...

Security readout for executives and security teams

CVE-2013-4413 affects the Ruby Wicked gem before 1.0.1. A web application using the vulnerable wizard step handling could let a remote attacker read files outside the intended application path. The practical business risk is exposure of sensitive local files, configuration, or secrets if the vulnerable gem is present and reachable. Exposure is most likely in Ruby or Rails applications that use the Wicked gem before version 1.0.1 and expose wizard step routing to remote users. Treat this as a priority fix for any internet-facing Ruby application using Wicked before 1.0.1. The vulnerability is old, but arbitrary file read can expose secrets and support follow-on compromise. If Wicked is absent, no action is needed beyond documenting non-exposure. Mitigation focus: Upgrade the Wicked gem to version 1.0.1 or later.; Check upstream Wicked project guidance and the confirming fix commit.; Prioritize internet-facing applications using Wicked wizard flows..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.