CVE-2026-44837 view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
Attackers can escape the intended directory in system tests by exploiting a flawed path prefix check, potentially accessing sibling directories.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44837?
CVE-2026-44837 is a medium-severity path traversal vulnerability in ViewComponent view_component, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.
Weakness: CWE-187
Which versions are affected by CVE-2026-44837?
2 open source packages ship an affected version, including view_component. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
view_component RubyGems | From 3.0.0 | 4.9.0 |
view_component RubyGems | From 3.0.0 | 4.9.0 |
Products include Viewcomponent View Component.
How do I fix CVE-2026-44837?
Upgrade view_component to 4.9.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44837 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44837 exists.
Other vulnerabilities in ViewComponent view_component
Sources
Also known as DEBIAN-CVE-2026-44837, GHSA-hg3h-g7xc-f7vp, UBUNTU-CVE-2026-44837.