Skip to content
OpenAdvisories
High · 7.5 Known exploited Scanner template Public exploit CVE-2019-5418 EUVD-2019-0375GHSA-86g5-2wh3-gc9j

Path Traversal in Action View

Published Mar 27, 2019 · Updated Oct 21, 2025 · Assigned by hackerone

Vendor: rails Product: https://github.com/rails/rails Package: actionview Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Affected products

VendorProductAffectedFixed
Rails https://github.com/rails/rails 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:5.2.2.1+dfsg-1 —
Debian 13 rails 2:5.2.2.1+dfsg-1 —
Debian 12 rails 2:5.2.2.1+dfsg-1 —
Debian 8 rails 2:4.1.8-1+deb8u5 DLA-1739-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS rails 2:4.2.10-0ubuntu4+esm2 USN-7646-1
Ubuntu Pro 16.04 LTS rails 2:4.2.6-1ubuntu0.1~esm2 USN-7646-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 3 rh-ror42-rubygem-actionpack +1 1:4.2.6-5.el6 RHSA-2019:1149
RHEL 3 rh-ror50-rubygem-actionpack +1 1:5.0.1-2.el6 RHSA-2019:1147
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat CloudForms 5 ansible-tower +5 3.4.3-1.el7at RHSA-2019:0796
Red Hat CloudForms 5 cfme +5 5.9.9.3-1.el7cf RHSA-2019:1289, RHSA-2019:0796

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP2 rmt-server 2.6.5-3.3.1 SUSE-SU-2020:3036-1
SLES 15 SP1 rmt-server 2.6.5-3.18.1 SUSE-SU-2020:3160-1
SLES 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SLE HPC 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SUSE OpenStack Cloud Crowbar 8 rubygem-actionpack-4_2 4.2.9-7.6.1 SUSE-SU-2019:0915-1
SUSE OpenStack Cloud 7 rubygem-actionpack-4_2 4.2.9-7.6.1 SUSE-SU-2019:0915-1
SUSE Enterprise Storage 4 rubygem-actionpack-4_2 4.2.9-7.6.1 SUSE-SU-2019:0915-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rails-6.0 +12 6.0.4.4-1.1 openSUSE-SU-2024:11832-1, openSUSE-SU-2024:11831-1, openSUSE-SU-2024:11828-1
openSUSE Leap 15.2 rmt-server 2.6.5-lp152.2.3.1 openSUSE-SU-2020:1993-1
openSUSE Leap 15.1 rmt-server 2.6.5-lp151.2.18.2 openSUSE-SU-2020:2000-1
openSUSE Leap 15.0 rubygem-actionpack-5_1 5.1.4-lp150.2.3.1 openSUSE-SU-2019:1344-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 12 repositories · most starred shown

  • mpgn/CVE-2019-5418 ★ 201 · Mar 16, 2019

    CVE-2019-5418 - File Content Disclosure on Ruby on Rails

  • mpgn/Rails-doubletap-RCE ★ 132 · Mar 23, 2019

    RCE on Rails 5.2.2 using a path traversal (CVE-2019-5418) and a deserialization of Ruby objects (CVE-2019-5420)

  • brompwnie/CVE-2019-5418-Scanner ★ 36 · Mar 19, 2019

    A multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418

  • random-robbie/CVE-2019-5418 ★ 5 · Nov 19, 2019
  • omarkurt/CVE-2019-5418 ★ 5 · Mar 18, 2019

    File Content Disclosure on Rails Test Case - CVE-2019-5418

  • Bad3r/RailroadBandit ★ 3 · Apr 1, 2019

    a demo for Ruby on Rails CVE-2019-5418

  • kailing0220/CVE-2019-5418 ★ 2 · Oct 17, 2022

    Ruby on Rails是一个 Web 应用程序框架,是一个相对较新的 Web 应用程序框架，构建在 Ruby 语言之上。这个漏洞主要是由于Ruby on Rails使用了指定参数的render file来渲染应用之外的视图，我们可以通过修改访问某控制器的请求包，通过“…/…/…/…/”来达到路径穿越的目的，然后再通过“{{”来进行模板查询路径的闭合，使得所要访问的文件被当做外部模板来解析。

  • daehyeok0618/CVE-2019-5418 ★ 0 · Apr 7, 2025

    WHS 3기 장대혁 취약한(CVE) Docker 환경 구성 과제입니다.

  • melardev/CVE-2019-5418 ★ 0 · Oct 24, 2019
  • ztgrace/CVE-2019-5418-Rails3 ★ 0 · Oct 4, 2019

    Rails 3 PoC of CVE-2019-5418

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems actionview >= 5.2.0, < 5.2.2.1 5.2.2.1 GHSA-86g5-2wh3-gc9j
RubyGems actionview >= 4.0.0, < 4.2.11.1 4.2.11.1 GHSA-86g5-2wh3-gc9j
RubyGems actionview >= 5.1.0, < 5.1.6.2 5.1.6.2 GHSA-86g5-2wh3-gc9j
RubyGems actionview >= 5.0.0, < 5.0.7.2 5.0.7.2 GHSA-86g5-2wh3-gc9j

Advisories 27

References