NetSight
IP …
high7.5Known exploitedPublic exploit code

CVE-2019-5418

Path Traversal in Action View

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-07-07. Federal due date: 2025-07-28.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

# File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this: ``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end ``` Rendering templates as opposed to files is not impacted by this vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this: ``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end ``` In summary, impacted calls to `render` look like this: ``` render file: "#{Rails.root}/some/file" ``` The vulnerability can be mitigated by changing to this: ``` render file: "#{Rails.root}/some/file", formats: [:html] ``` Other calls to `render` are not impacted. Alternatively, the following monkey patch can be applied in an initializer: ``` ruby $ cat config/initializers/formats_filter.rb # frozen_string_literal: true ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "*/*" end end end) ``` Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub

Affected packages

EcosystemPackageAffectedFixed in
rubygemsactionview>= 5.1.0, <= 5.1.6.15.1.6.2

Affected products

VendorProductAffected versions
RubyonrailsRails
from 3.0.0 before 4.2.11.1
from 5.0.0 before 5.0.7.2
from 5.1.0 before 5.1.6.2
from 5.2.0 before 5.2.2.1
DebianDebian Linux
Version 8.0
RedhatCloudforms
Versions 4.7, 4.6
OpensuseLeap
Version 15.0
FedoraprojectFedora
Version 30
RedhatSoftware Collections
Version 1.0

Weakness classification

CWE-22

References