CVE-2019-5418 Rails Ruby on Rails Path Traversal

Q: Which versions are affected by CVE-2019-5418?

8 open source packages ship an affected version, including actionview. It affects 6 products.

Q: Is CVE-2019-5418 being exploited?

Yes. Attackers have exploited CVE-2019-5418 in the wild since at least 7 Jul 2025.

Q: How do I fix CVE-2019-5418?

Upgrade actionview to a fixed version for your release line: 4.2.11.1, 5.0.7.2, 5.1.6.2 or 5.2.2.1. US federal agencies must fix it by 28 Jul 2025.

Exploited in the wild High 7.5 Published 27 Mar 2019 Updated 21 Oct 2025

Attackers can read arbitrary files on the server by sending specially crafted Accept headers in Ruby on Rails applications.

Exploited in the wild: Since 7 Jul 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-5418?

CVE-2019-5418 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 27 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Weakness: CWE-22

Which versions are affected by CVE-2019-5418?

8 open source packages ship an affected version, including actionview. It affects 6 products.

Package	Affected	Fixed in
`actionview` RubyGems	From `4.0.0`	`4.2.11.1`
`actionview` RubyGems	From `4.0.0`	`4.2.11.1`
`actionview` RubyGems	From `5.0.0`	`5.0.7.2`
`actionview` RubyGems	From `5.0.0`	`5.0.7.2`
`actionview` RubyGems	From `5.1.0`	`5.1.6.2`
`actionview` RubyGems	From `5.1.0`	`5.1.6.2`

2 more packages

`actionview` RubyGems	From `5.2.0`	`5.2.2.1`
`actionview` RubyGems	From `5.2.0`	`5.2.2.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Redhat Cloudforms, Redhat Software Collections, Rubyonrails Rails.

How do I fix CVE-2019-5418?

Upgrade actionview to a fixed version for your release line: 4.2.11.1, 5.0.7.2, 5.1.6.2 or 5.2.2.1. US federal agencies must fix it by 28 Jul 2025.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-5418 being exploited?

Yes. Attackers have exploited CVE-2019-5418 in the wild since at least 7 Jul 2025.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 12 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-5418, GHSA-86g5-2wh3-gc9j, UBUNTU-CVE-2019-5418, USN-7646-1.