Actively exploited in the wild
Rails Ruby on Rails Path Traversal Vulnerability
Rails - Ruby on Rails · Listed in the CISA KEV since 2025-07-07. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2019-5418
HighCVSS 7.5KEVSummary
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Risk Assessment
An attacker could exploit this vulnerability to read the contents of sensitive files on the server, potentially leading to data leakage.
Recommendation
Upgrade Action View to version 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 or later, which includes the fix.
Other vulnerabilities in Action View
Original NVD description (English source)
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS