CVE-2016-2097: Possible Information Leak Vulnerability in ActionView

Applications that pass unverified user input to the render method in a controller may be vulnerable to an information leak vulnerability. Impacted code will look something like this: def index; render params[:id]; end. Carefully crafted requests can cause the above code to render files from unexpected places like outside the application’s view directory, and can possibly escalate this to a remote code execution attack.