CVE-2019-5418
Rails Ruby on Rails Path Traversal Vulnerability
Published Mar 27, 2019 · updated Jun 16, 2026 · rubyonrails rails
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2019 · Catalog
Detected
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Jul 7, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jul 28, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Jul 28, 2025
Affected
- cpe debian/debian linux8.0
- cpe fedoraproject/fedora30
- cpe opensuse/leap15.0
- cpe redhat/cloudforms4.6
- cpe redhat/cloudforms4.7
- cpe rubyonrails/railsversion unspecified
- vendor Rails Ruby on Railsversion unspecified
Sources
- CISA KEVCVE-2019-5418
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to can cause arbitrary files on the target server to be rendered, disclosing the file contents.
cisa.gov - CVE.orgCVE-2019-5418
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-5418
30-day exploitation probability 98.5%
first.org - Exploit Database46585
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_gather/rails_doubletap_file_read
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2019-5418
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
Packet Storm link already published on the finding.
packetstormsecurity.com