Rails · Ruby on Rails
CVE-2019-5418
Rails Ruby on Rails Path Traversal Vulnerability
What it is
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
CISA: Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: July 28, 2025
- Added to the CISA list
- July 7, 2025
- Published
- March 27, 2019
- Severity
- High 7.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (12)
- https://access.redhat.com/errata/RHSA-2019:0796
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T…
- https://access.redhat.com/errata/RHSA-2019:1149
- https://access.redhat.com/errata/RHSA-2019:1147
- https://access.redhat.com/errata/RHSA-2019:1289
- https://www.exploit-db.com/exploits/46585/
- http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
- http://www.openwall.com/lists/oss-security/2019/03/22/1
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q
- https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
More exploited flaws from Rails
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 25, 2022 | Directory Traversal | Ruby on Rails | High 7.5 | 54% |
| Mar 25, 2022 | Directory Traversal | Ruby on Rails | High 7.5 | 96% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.