EXPLOIT/ALERT Back to feed

Rails Ruby on Rails Path Traversal Vulnerability

Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.

Published 8 Oct 2026Updated 8 Oct 2026424 sources
CVSS 7.5 ✓ VERIFIED REFERENCE△ CISA KEV
Overview Sources History

What happened

Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.

Affected versions

Ruby on Rails: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
Exploit-DB 46585Rails 5.2.1 - Arbitrary File Content DisclosureNotoriousRebel2019-03-21VerifiedSploitusProof-of-concept exploit for CVE-2019-5418. CVSS 7.5.Sploitus index2026-10-08T20:04:38+00:00CandidatePoC-in-GitHub · mpgn/CVE-2019-5418CVE-2019-5418 - File Content Disclosure on Ruby on Rails★ 201mpgn2019-03-16CandidatePoC-in-GitHub · omarkurt/CVE-2019-5418File Content Disclosure on Rails Test Case - CVE-2019-5418★ 5omarkurt2019-03-18CandidatePoC-in-GitHub · brompwnie/CVE-2019-5418-ScannerA multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418★ 36brompwnie2019-03-19CandidatePoC-in-GitHub · mpgn/Rails-doubletap-RCERCE on Rails 5.2.2 using a path traversal (CVE-2019-5418) and a deserialization of Ruby objects (CVE-2019-5420)★ 132mpgn2019-03-23CandidatePoC-in-GitHub · Bad3r/RailroadBandita demo for Ruby on Rails CVE-2019-5418★ 3Bad3r2019-04-01CandidatePoC-in-GitHub · ztgrace/CVE-2019-5418-Rails3Rails 3 PoC of CVE-2019-5418★ 0ztgrace2019-10-04CandidatePoC-in-GitHub · melardev/CVE-2019-5418★ 0melardev2019-10-24CandidatePoC-in-GitHub · random-robbie/CVE-2019-5418★ 5random-robbie2019-11-19CandidatePoC-in-GitHub · kailing0220/CVE-2019-5418Ruby on Rails是一个 Web 应用程序框架,是一个相对较新的 Web 应用程序框架，构建在 Ruby 语言之上。这个漏洞主要是由于Ruby on Rails使用了指定参数的render file来渲染应用之外的视图，我们可以通过修改访问某控制器的请求包，通过“…/…/…/…/”来达到路径穿越的目的，然后再通过“{{”来进行模板查询路径的闭合，使得所要访问的文件被当做外部模板来解析。★ 2kailing02202022-10-17CandidatePoC-in-GitHub · daehyeok0618/CVE-2019-5418WHS 3기 장대혁 취약한(CVE) Docker 환경 구성 과제입니다.★ 0daehyeok06182025-04-07CandidatePoC-in-GitHub · CyberCTF/vulhub-rails-cve-2019-5418Vulhub rails/CVE-2019-5418: Ruby on Rails Accept Header File Disclosure (CVE-2019-5418), run with Isoloom★ 0CyberCTF2026-10-08CandidatePoC-in-GitHub · 5t1ck/rails-doubletap-pyAutomated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.★ 05t1ck2026-10-13Candidate
CorrectionsReport an issue