Read the docs
TI-2019-03828 Aliases CVE-2019-5418GHSA-86g5-2wh3-gc9j

Path traversal in Rails https://github.com/rails/rails

Priority CRITICAL 90Exploited in the wildCWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Why it matters now

Exploitation Active In CISA KEV since 2025-07-07CISA due date 2025-07-28
EPSS 0.98507 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed actionview (RubyGems): 5.2.2.1, 4.2.11.1, 5.1.6.2 +1Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Railshttps://github.com/rails/rails5.2.2.1; 5.1.6.2; 5.0.7.2; 4.2.11.1—No fix listedCNA
—actionview (RubyGems)5.2.0 to before 5.2.2.15.2.2.1Patch availableGHSA-86g5-2wh3-gc9j
—actionview (RubyGems)4.0.0 to before 4.2.11.14.2.11.1Patch availableGHSA-86g5-2wh3-gc9j
—actionview (RubyGems)5.1.0 to before 5.1.6.25.1.6.2Patch availableGHSA-86g5-2wh3-gc9j
—actionview (RubyGems)5.0.0 to before 5.0.7.25.0.7.2Patch availableGHSA-86g5-2wh3-gc9j
  • https://github.com/rails/rails VendorRails Affected 5.2.2.1; 5.1.6.2; 5.0.7.2; 4.2.11.1 Fixed in — No fix listed CNA
  • actionview (RubyGems) Vendor— Affected 5.2.0 to before 5.2.2.1 Fixed in 5.2.2.1 Patch available GHSA-86g5-2wh3-gc9j
  • actionview (RubyGems) Vendor— Affected 4.0.0 to before 4.2.11.1 Fixed in 4.2.11.1 Patch available GHSA-86g5-2wh3-gc9j
  • actionview (RubyGems) Vendor— Affected 5.1.0 to before 5.1.6.2 Fixed in 5.1.6.2 Patch available GHSA-86g5-2wh3-gc9j
  • actionview (RubyGems) Vendor— Affected 5.0.0 to before 5.0.7.2 Fixed in 5.0.7.2 Patch available GHSA-86g5-2wh3-gc9j

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*3.0.0 to before 4.2.11.1; 5.0.0 to before 5.0.7.2; 5.1.0 to before 5.1.6.2; 5.2.0 to before 5.2.2.1VulnerableRails
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*4.7VulnerableRed Hat
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*4.6VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.2.11.1; 5.0.0 to before 5.0.7.2; 5.1.0 to before 5.1.6.2; 5.2.0 to before 5.2.2.1 Vulnerable ·Rails
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Red Hat
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-86g5-2wh3-gc9j actionview (RubyGems) Fixed in 5.2.2.1 Advisory →
  • Fix · GHSA-86g5-2wh3-gc9j actionview (RubyGems) Fixed in 4.2.11.1 Advisory →
  • Fix · GHSA-86g5-2wh3-gc9j actionview (RubyGems) Fixed in 5.1.6.2 Advisory →
  • Fix · GHSA-86g5-2wh3-gc9j actionview (RubyGems) Fixed in 5.0.7.2 Advisory →

Red Hat 4 advisories

  • RHSA-2019:1289 Released 2019-05-29 · Red Hat rating Important
    CloudForms 4.6.9 security, bug fix and enhancement update
    • CloudForms Management Engine 5.9 cfme-5.9.9.3-1.el7cf, cfme-amazon-smartstate-5.9.9.3-1.el7cf, cfme-appliance-5.9.9.3-1.el7cf +3
  • RHSA-2019:1149 Released 2019-05-13 · Red Hat rating Important
    rh-ror42-rubygem-actionpack security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ror42-rubygem-actionpack-1:4.2.6-5.el6, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ror42-rubygem-actionpack-1:4.2.6-5.el6, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
  • RHSA-2019:1147 Released 2019-05-13 · Red Hat rating Important
    rh-ror50-rubygem-actionpack security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ror50-rubygem-actionpack-1:5.0.1-2.el6, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ror50-rubygem-actionpack-1:5.0.1-2.el6, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
Show 1 more Red Hat advisories
  • RHSA-2019:0796 Released 2019-04-23 · Red Hat rating Important
    CloudForms 4.7.3 security, bug fix and enhancement update
    • CloudForms Management Engine 5.10 ansible-tower-3.4.3-1.el7at, ansible-tower-server-3.4.3-1.el7at, ansible-tower-setup-3.4.3-1.el7at +9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Rails https://github.com/rails/rails — FEDORA-2019-1cfe24db5c

    3 records Highest priority Priority CRITICAL 2 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03830 Command injection in Rails https://github.com/rails/railsPriority CRITICAL 85
    • TI-2019-03829 Uncontrolled resource consumption in Rails https://github.com/rails/railsPriority MEDIUM 44
    Show all 3 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — openSUSE-SU-2019:1344

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03829 Uncontrolled resource consumption in Rails https://github.com/rails/railsPriority MEDIUM 44
    Show all 2 records → Advisory →
Show 4 more groups
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:0796

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03829 Uncontrolled resource consumption in Rails https://github.com/rails/railsPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:1147

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03829 Uncontrolled resource consumption in Rails https://github.com/rails/railsPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:1149

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03829 Uncontrolled resource consumption in Rails https://github.com/rails/railsPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:1289

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03829 Uncontrolled resource consumption in Rails https://github.com/rails/railsPriority MEDIUM 44
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5.10Fixed RHSA-2019:0796
CloudForms Management Engine 5.9Fixed RHSA-2019:1289
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:1147, RHSA-2019:1149

Timeline

  1. 2025-07-07 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2019-5418
  3. 2026-10-03 Alias added: GHSA-86g5-2wh3-gc9j

References

Exploit 2

Patch 3

Advisory 8

Other 9

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
  • TI-2013-00263 lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences