System	Score	Found at
cvssv3.1	7.5
ssvc	Attend

Reference id	Reference type	URL
		http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
		http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
		https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q
		https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
		https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
		https://www.exploit-db.com/exploits/46585/
		http://www.openwall.com/lists/oss-security/2019/03/22/1
RHSA-2019:0796		https://access.redhat.com/errata/RHSA-2019:0796
RHSA-2019:1147		https://access.redhat.com/errata/RHSA-2019:1147
RHSA-2019:1149		https://access.redhat.com/errata/RHSA-2019:1149
RHSA-2019:1289		https://access.redhat.com/errata/RHSA-2019:1289
Y43636TH4D6T46IC6N2RQVJTRFJAAYGA	Advisory	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/

Data source	KEV
Date added	July 7, 2025
Description	Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
Required action	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due date	July 28, 2025
Note	https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-5418
Ransomware campaign use	Unknown

Data source	Metasploit
Description	This module uses a path traversal vulnerability in Ruby on Rails versions =< 5.2.2 to read files on a target server.
Note	AKA: - DoubleTap Stability: - unknown-stability Reliability: - unknown-reliability SideEffects: - unknown-side-effects
Ransomware campaign use	Unknown
Source URL	https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/rails_doubletap_file_read.rb

Data source	Exploit-DB
Date added	March 21, 2019
Description	Rails 5.2.1 - Arbitrary File Content Disclosure
Ransomware campaign use	Unknown
Source publication date	March 21, 2019
Exploit type	webapps
Platform	multiple
Source update date	March 21, 2019

No EPSS data available for this advisory.

Patch URL
There are no known patches.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at None

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

---

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-07-17T03:55:43Z/ Found at None

---