CVE-2019-5418: There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause…

high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

KEVEXPLOIT

CISA Known Exploited Vulnerabilitydue 2025-07-28

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	rails	< rails 2:5.2.2.1+dfsg-1 (bookworm)	rails 2:5.2.2.1+dfsg-1 (bookworm)
fedoraproject	fedora	—	—
opensuse	leap	—	—
rails	actionview	>= 4.0.0 < 4.2.11.1	4.2.11.1
rails	actionview	>= 5.0.0 < 5.0.7.2	5.0.7.2
rails	actionview	>= 5.1.0 < 5.1.6.2	5.1.6.2
rails	actionview	>= 5.2.0 < 5.2.2.1	5.2.2.1
rails	https_github.com_rails_rails	—	—
rails	https_github.com_rails_rails	—	—
rails	https_github.com_rails_rails	—	—
rails	https_github.com_rails_rails	—	—
redhat	cloudforms	—	—
redhat	cloudforms	—	—
redhat	software_collections	—	—
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 0 < 2:4.2.6-1ubuntu0.1~esm2	2:4.2.6-1ubuntu0.1~esm2
rubyonrails	rails	>= 0 < 2:4.2.10-0ubuntu4+esm2	2:4.2.10-0ubuntu4+esm2
rubyonrails	rails	>= 3.0.0 < 4.2.11.1	4.2.11.1
rubyonrails	rails	>= 5.0.0 < 5.0.7.2	5.0.7.2
rubyonrails	rails	>= 5.1.0 < 5.1.6.2	5.1.6.2
rubyonrails	rails	>= 5.2.0 < 5.2.2.1	5.2.2.1

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

osv7.5HIGH

vulncheck7.5HIGH

cisa7.5HIGH