{"id":"CVE-2019-5418","published":"2019-03-27T14:29:01Z","modified":"2026-06-17T02:37:39Z","title":"Rails Ruby on Rails Path Traversal Vulnerability","vendor":"Rails","product":"Ruby on Rails","tier":"core","eol":null,"description":{"text":"There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in Action View, the view rendering component of Ruby on Rails, lets specially crafted Accept headers expose the contents of arbitrary files on the server's filesystem in affected versions prior to 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1, and in version 3. An attacker needs only network access to the application, with no authentication, no user interaction, and no special configuration required to trigger the disclosure.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:42Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.98507,"percentile":0.9992,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-07-07","dueDate":"2025-07-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-5418","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-07-07","exploitedFirstSeen":"2025-07-07","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-07"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2019-5418","date":"2025-08-07"},{"url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf","date":"2025-11-12"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2019/03/22/1","tags":["Mailing List","Mitigation","Patch","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0796","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1147","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1149","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1289","tags":["Third Party Advisory"]},{"url":"https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q","tags":["Permissions Required"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/","tags":["Third Party Advisory"]},{"url":"https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46585/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2019/03/22/1","tags":["Mailing List","Mitigation","Patch","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0796","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1147","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1149","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1289","tags":["Third Party Advisory"]},{"url":"https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q","tags":["Permissions Required"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/","tags":["Third Party Advisory"]},{"url":"https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46585/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5418","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated crafted HTTP headers exploit public-facing web app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"specially crafted accept headers can cause","start":117,"end":159}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary file contents read from local filesystem","mappingType":"primary_impact","evidence":[{"from":"description","quote":"contents of arbitrary files on the target system's filesystem to be exposed","start":160,"end":235}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=5.2.0, <5.2.2.1",">=4.0.0, <4.2.11.1",">=5.1.0, <5.1.6.2",">=5.0.0, <5.0.7.2"],"patched":["5.2.2.1","4.2.11.1","5.1.6.2","5.0.7.2"],"from":["GHSA-86g5-2wh3-gc9j"],"provenance":"source"}],"advisories":[{"id":"GHSA-86g5-2wh3-gc9j","url":"https://github.com/advisories/GHSA-86g5-2wh3-gc9j","severity":"HIGH","ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=5.2.0, <5.2.2.1"],"patched":["5.2.2.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-86g5-2wh3-gc9j","url":"https://github.com/advisories/GHSA-86g5-2wh3-gc9j","severity":"HIGH","ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=4.0.0, <4.2.11.1"],"patched":["4.2.11.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-86g5-2wh3-gc9j","url":"https://github.com/advisories/GHSA-86g5-2wh3-gc9j","severity":"HIGH","ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=5.1.0, <5.1.6.2"],"patched":["5.1.6.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-86g5-2wh3-gc9j","url":"https://github.com/advisories/GHSA-86g5-2wh3-gc9j","severity":"HIGH","ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=5.0.0, <5.0.7.2"],"patched":["5.0.7.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2019-0375","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0375","exploited":true,"exploitedSince":"2025-07-07","provenance":"source"},"exploits":[{"id":46585,"url":"https://www.exploit-db.com/exploits/46585","title":"Rails 5.2.1 - Arbitrary File Content Disclosure","type":"webapps","platform":"multiple","date":"2019-03-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-03-21"},"pocGithub":{"count":11,"skipped":1,"earliest":"2019-03-16","earliestUrl":"https://github.com/mpgn/CVE-2019-5418","repos":[{"name":"mpgn/CVE-2019-5418","url":"https://github.com/mpgn/CVE-2019-5418","stars":201,"created":"2019-03-16"},{"name":"mpgn/Rails-doubletap-RCE","url":"https://github.com/mpgn/Rails-doubletap-RCE","stars":132,"created":"2019-03-23"},{"name":"brompwnie/CVE-2019-5418-Scanner","url":"https://github.com/brompwnie/CVE-2019-5418-Scanner","stars":36,"created":"2019-03-19"},{"name":"omarkurt/CVE-2019-5418","url":"https://github.com/omarkurt/CVE-2019-5418","stars":5,"created":"2019-03-18"},{"name":"random-robbie/CVE-2019-5418","url":"https://github.com/random-robbie/CVE-2019-5418","stars":5,"created":"2019-11-19"}]},"metasploit":[{"name":"Ruby On Rails File Content Disclosure ('doubletap')","module":"auxiliary/gather/rails_doubletap_file_read","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/rails_doubletap_file_read.rb"}],"nuclei":[{"id":"CVE-2019-5418","name":"Rails File Content Disclosure","severity":"high","path":"http/cves/2019/CVE-2019-5418.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5418.yaml"}],"first":{"date":"2019-03-16","source":"PoC-in-GitHub","url":"https://github.com/mpgn/CVE-2019-5418"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html","https://www.exploit-db.com/exploits/46585/","https://www.exploit-db.com/exploits/46585"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2019-03-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2019-03-21","url":"https://github.com/mpgn/CVE-2019-5418","provenance":"source"},{"date":"2019-03-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5418","provenance":"source"},{"date":"2025-07-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2025-07-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0375","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2294},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 481 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 11 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-rails-ruby-on-rails-cwe-22","packageHistory":[{"cve":"CVE-2016-0752","published":"2016-02-16","fixed":"4.2.5.1","kev":true},{"cve":"CVE-2020-8163","published":"2020-07-02","fixed":"4.2.11.3","kev":false,"link":{"from":"CVE-2019-5418","to":"CVE-2020-8163","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"4.2.11.1","toFixed":"4.2.11.3","daysApart":463}]}},{"cve":"CVE-2016-6316","published":"2016-09-07","fixed":"5.0.0.1","kev":false},{"cve":"CVE-2019-5418","published":"2019-03-27","fixed":"5.2.2.1","kev":true},{"cve":"CVE-2019-5419","published":"2019-03-27","fixed":"6.0.0.beta3","kev":false},{"cve":"CVE-2020-5267","published":"2020-03-19","fixed":"6.0.2.2","kev":false,"link":{"from":"CVE-2019-5418","to":"CVE-2020-5267","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"5.2.2.1","toFixed":"5.2.4.2","daysApart":358}]}},{"cve":"CVE-2020-8167","published":"2020-06-19","fixed":"6.0.3.1","kev":false}],"package":"RubyGems:actionview"}}