CVE-2019-5418
published 2019-03-27CVE-2019-5418: There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause…
PriorityP189high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2025-07-28
Exploited in the wild
EPSS
98.51%
99.9th percentile
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | rails | < rails 2:5.2.2.1+dfsg-1 (bookworm) | rails 2:5.2.2.1+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| rails | actionview | >= 4.0.0 < 4.2.11.1 | 4.2.11.1 |
| rails | actionview | >= 5.0.0 < 5.0.7.2 | 5.0.7.2 |
| rails | actionview | >= 5.1.0 < 5.1.6.2 | 5.1.6.2 |
| rails | actionview | >= 5.2.0 < 5.2.2.1 | 5.2.2.1 |
| rails | https_github.com_rails_rails | — | — |
| rails | https_github.com_rails_rails | — | — |
| rails | https_github.com_rails_rails | — | — |
| rails | https_github.com_rails_rails | — | — |
| redhat | cloudforms | — | — |
| redhat | cloudforms | — | — |
| redhat | software_collections | — | — |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:4.2.6-1ubuntu0.1~esm2 | 2:4.2.6-1ubuntu0.1~esm2 |
| rubyonrails | rails | >= 0 < 2:4.2.10-0ubuntu4+esm2 | 2:4.2.10-0ubuntu4+esm2 |
| rubyonrails | rails | >= 3.0.0 < 4.2.11.1 | 4.2.11.1 |
| rubyonrails | rails | >= 5.0.0 < 5.0.7.2 | 5.0.7.2 |
| rubyonrails | rails | >= 5.1.0 < 5.1.6.2 | 5.1.6.2 |
| rubyonrails | rails | >= 5.2.0 < 5.2.2.1 | 5.2.2.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by inspecting HTTP Accept headers for path traversal sequences (e.g., '../') combined with a trailing '{{' double-brace, which is the crafted payload pattern for this vulnerability. ↗
- →Alert on HTTP responses with status 200 or 500 whose body matches 'root:.*:0:0:' — this indicates successful /etc/passwd disclosure via the crafted Accept header. ↗
- →Use Shodan query 'cpe:"cpe:2.3:a:rubyonrails:rails"' to identify internet-exposed Rails instances potentially vulnerable to this CVE. ↗
- →The vulnerability requires calls to 'render file:' in the Rails application combined with the malicious Accept header; prioritize detection on endpoints known to use file rendering. ↗
- →Code execution cannot be ruled out if the attacker gains access to sensitive files (e.g., credentials, keys); monitor for follow-on access attempts after file disclosure. ↗
- ·The vulnerability is only exploitable when the Rails application uses 'render file:' in its controllers/views. Applications not using this pattern are not directly exploitable. ↗
- ·All Rails v3 releases are affected and have no vendor-supplied patch; discontinue use or apply compensating controls if running v3. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vulncheck7.5HIGH
cisa7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
rails vulnerability
osv·2025-07-17·CVSS 7.5
CVE-2019-5418 [HIGH] rails vulnerability
rails vulnerability
It was discovered that Rails did not correctly handle headers. An
attacker could potentially use this issue to view arbitrary files
on a target server. (CVE-2019-5418)
OSV
CVE-2019-5418: There is a File Content Disclosure vulnerability in Action View <5
osv·2019-03-27·CVSS 7.5
CVE-2019-5418 [HIGH] CVE-2019-5418: There is a File Content Disclosure vulnerability in Action View <5
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
OSV
Path Traversal in Action View
osv·2019-03-13
CVE-2019-5418 [HIGH] Path Traversal in Action View
Path Traversal in Action View
# File Content Disclosure in Action View
Impact
There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this:
``` ruby
class UserController of GitHub
GHSA
Path Traversal in Action View
ghsa·2019-03-13
CVE-2019-5418 [HIGH] CWE-22 Path Traversal in Action View
Path Traversal in Action View
# File Content Disclosure in Action View
Impact
There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this:
``` ruby
class UserController of GitHub
VulnCheck
Rails Ruby on Rails Path Traversal Vulnerability
vulncheck·2019·CVSS 7.5
CVE-2019-5418 [HIGH] CWE-22 Rails Ruby on Rails Path Traversal Vulnerability
Rails Ruby on Rails Path Traversal Vulnerability
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
Affected: Rails Ruby on Rails
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://app.crowdsec.net/cti/cve-explorer/CVE-2019-5418; https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf; https
Ubuntu
Rails vulnerability
vendor_ubuntu·2025-07-17·CVSS 7.5
CVE-2019-5418 [HIGH] Rails vulnerability
Title: Rails vulnerability
Summary: Rails could be made to expose sensitive information over the
network.
It was discovered that Rails did not correctly handle headers. An
attacker could potentially use this issue to view arbitrary files
on a target server. (CVE-2019-5418)
Instructions: In general, a standard system update will make all the necessary changes.
CISA
Rails Ruby on Rails Path Traversal Vulnerability
cisa·2025-07-07·CVSS 7.5
CVE-2019-5418 [HIGH] CWE-22 Rails Ruby on Rails Path Traversal Vulnerability
Vulnerability: Rails Ruby on Rails Path Traversal Vulnerability
Affected: Rails Ruby on Rails
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-5418
Remediation Due Date: 2025-07-28
Red Hat
rubygem-actionpack: render file directory traversal in Action View
vendor_redhat·2019-03-13·CVSS 7.5
CVE-2019-5418 [HIGH] CWE-200 rubygem-actionpack: render file directory traversal in Action View
rubygem-actionpack: render file directory traversal in Action View
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to 'render file:', can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: This issue did affect the versions of rh
Debian
CVE-2019-5418: rails - There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6...
vendor_debian·2019·CVSS 7.5
CVE-2019-5418 [HIGH] CVE-2019-5418: rails - There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6...
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Scope: local
bookworm: resolved (fixed in 2:5.2.2.1+dfsg-1)
bullseye: resolved (fixed in 2:5.2.2.1+dfsg-1)
forky: resolved (fixed in 2:5.2.2.1+dfsg-1)
sid: resolved (fixed in 2:5.2.2.1+dfsg-1)
trixie: resolved (fixed in 2:5.2.2.1+dfsg-1)
Suricata
ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt
suricata·2019-03-19·CVSS 7.5
CVE-2019-5418 [HIGH] ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt
ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt"; flow:established,to_server; http.accept; content:"../"; reference:url,github.com/mpgn/CVE-2019-5418; classtype:web-application-attack; sid:2027096; rev:3; metadata:attack_target Web_Server, created_at 2019_03_19, cve CVE_2019_5418, deployment Datacenter, signature_severity Informational, updated_at 2020_08_28;)
Exploit-DB
Rails 5.2.1 - Arbitrary File Content Disclosure
exploitdb·2019-03-21·CVSS 7.5
CVE-2019-5418 [HIGH] Rails 5.2.1 - Arbitrary File Content Disclosure
Rails 5.2.1 - Arbitrary File Content Disclosure
---
'''
Exploit Title: File Content Disclosure on Rails
Date: CVE disclosed 3/16 today's date is 3/20
Exploit Author: NotoriousRebel
Vendor Homepage: https://rubyonrails.org/
Software Link: https://github.com/rails/rails
Version: Versions Affected: all Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1
Tested on: Rails 5.2.1 (Using ubuntu on linux subsystem for Windows)
CVE: 2019-5418
'''
import sys
try:
import requests
except ImportError:
print('\n\033[93m[!] Requests library not found, please install before proceeding.\n\n \033[0m')
sys.exit(1)
def banner():
banner = """
Arbitrary Traversal exploit for Ruby on Rails
CVE-2019-5418
"""
print(banner)
def check_args():
if len(sys.argv) != 2:
print("Invalid number of argument
Metasploit
Ruby On Rails File Content Disclosure ('doubletap')
metasploit
Ruby On Rails File Content Disclosure ('doubletap')
Ruby On Rails File Content Disclosure ('doubletap')
This module uses a path traversal vulnerability in Ruby on Rails versions =< 5.2.2 to read files on a target server.
Nuclei
Rails File Content Disclosure
nuclei·CVSS 7.5
CVE-2019-5418 [HIGH] Rails File Content Disclosure
Rails File Content Disclosure
Rails <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed.
Template:
id: CVE-2019-5418
info:
name: Rails File Content Disclosure
author: omarkurt
severity: high
description: Rails <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed.
impact: |
This vulnerability can lead to unauthorized access to sensitive information stored on the server.
remediation: |
Apply the patch provided by the Rails team or
Bugzilla
CVE-2019-5418 rubygem-actionpack: render file directory traversal in Action View
bugzilla·2019-03-15·CVSS 7.5
CVE-2019-5418 [HIGH] CVE-2019-5418 rubygem-actionpack: render file directory traversal in Action View
CVE-2019-5418 rubygem-actionpack: render file directory traversal in Action View
There is a possible file content disclosure vulnerability in Action View.
Specially crafted accept headers in combination with calls to `render file:`
can cause arbitrary files on the target server to be rendered, disclosing the
file contents.
External References:
https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ
https://github.com/mpgn/CVE-2019-5418
Discussion:
Created rubygem-actionview tracking bugs for this issue:
Affects: fedora-all [bug 1689161]
---
References:
https://seclists.org/oss-sec/2019/q1/178
---
Note the patch to fix this issue is same with CVE-2019-5419.
---
Upstream commit:
4.2 https://github.com/rails/rails/commit/58ed245e80a8710fbe31e91417bfd1
Bugzilla
CVE-2019-5418 CVE-2019-5419 rubygem-actionview: various flaws [fedora-all]
bugzilla·2019-03-15·CVSS 7.5
CVE-2019-5418 [HIGH] CVE-2019-5418 CVE-2019-5419 rubygem-actionview: various flaws [fedora-all]
CVE-2019-5418 CVE-2019-5419 rubygem-actionview: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Greynoiseio
NoiseLetter July 2025
blogs_greynoiseio
NoiseLetter July 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.htmlhttp://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.htmlhttp://www.openwall.com/lists/oss-security/2019/03/22/1https://access.redhat.com/errata/RHSA-2019:0796https://access.redhat.com/errata/RHSA-2019:1147https://access.redhat.com/errata/RHSA-2019:1149https://access.redhat.com/errata/RHSA-2019:1289https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Qhttps://lists.debian.org/debian-lts-announce/2019/03/msg00042.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/https://www.exploit-db.com/exploits/46585/http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.htmlhttp://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.htmlhttp://www.openwall.com/lists/oss-security/2019/03/22/1https://access.redhat.com/errata/RHSA-2019:0796https://access.redhat.com/errata/RHSA-2019:1147https://access.redhat.com/errata/RHSA-2019:1149https://access.redhat.com/errata/RHSA-2019:1289https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Qhttps://lists.debian.org/debian-lts-announce/2019/03/msg00042.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/https://www.exploit-db.com/exploits/46585/https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5418
2019-03-27
Published
2025-07-07
Added to CISA KEV
Exploited in the wild