Advisory details:
gitlab / gem/actionview/CVE-2019-5418
| Advisory ID | gitlab/gem/actionview/CVE-2019-5418 |
| Aliases |
CVE-2019-5418
GHSA-86g5-2wh3-gc9j |
| Summary | Path Traversal in Action View # File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this: ``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end ``` Rendering templates as opposed to files is not impacted by this vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this: ``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end ``` In summary, impacted calls to `render` look like this: ``` render file: "#{Rails.root}/some/file" ``` The vulnerability can be mitigated by changing to this: ``` render file: "#{Rails.root}/some/file", formats: [:html] ``` Other calls to `render` are not impacted. Alternatively, the following monkey patch can be applied in an initializer: ``` ruby $ cat config/initializers/formats_filter.rb # frozen_string_literal: true ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "*/*" end end end) ``` Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| Data source | Metasploit |
|---|---|
| Description | This module uses a path traversal vulnerability in Ruby on Rails versions =< 5.2.2 to read files on a target server. |
| Note | AKA: - DoubleTap Stability: - unknown-stability Reliability: - unknown-reliability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/rails_doubletap_file_read.rb |
| Data source | KEV |
|---|---|
| Date added | July 7, 2025 |
| Description | Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Due date | July 28, 2025 |
| Note | https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-5418 |
| Ransomware campaign use | Unknown |
| Data source | Exploit-DB |
|---|---|
| Date added | March 21, 2019 |
| Description | Rails 5.2.1 - Arbitrary File Content Disclosure |
| Ransomware campaign use | Unknown |
| Source publication date | March 21, 2019 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | March 21, 2019 |
| Data source | Metasploit |
|---|---|
| Description | This module uses a path traversal vulnerability in Ruby on Rails versions =< 5.2.2 to read files on a target server. |
| Note | AKA: - DoubleTap Stability: - unknown-stability Reliability: - unknown-reliability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/rails_doubletap_file_read.rb |
| Data source | KEV |
|---|---|
| Date added | July 7, 2025 |
| Description | Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Due date | July 28, 2025 |
| Note | https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-5418 |
| Ransomware campaign use | Unknown |
| Data source | Exploit-DB |
|---|---|
| Date added | March 21, 2019 |
| Description | Rails 5.2.1 - Arbitrary File Content Disclosure |
| Ransomware campaign use | Unknown |
| Source publication date | March 21, 2019 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | March 21, 2019 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-07-17T03:55:43Z/
Decision: Attend
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2019/5xxx/CVE-2019-5418.json
Source Advisory: vulnrichment/CVE-2019-5418
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]