CVE-2019-5418There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the targ…
Updated under an hour ago ()
Does this affect you?
It affects Rails https://github.com/rails/rails and 6 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Jul 7, 2025; federal agencies had to remediate by Jul 28, 2025. Treat that date as your deadline.
Do this next
Free account, 1 product
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
- CVSS
- 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Added to CISA KEV Jul 7, 2025; federal remediation due Jul 28, 2025Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 98.51% (percentile 100)
- Assigned by
- hackerone
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Rails https://github.com/rails/rails rails:https_github.com_rails_rails (from the name) | 5.2.2.1; 5.1.6.2; 5.0.7.2; 4.2.11.1 | CNA record |
rubyonrails rails rubyonrails:rails | from 3.0.0 before 4.2.11.1; from 5.0.0 before 5.0.7.2; from 5.1.0 before 5.1.6.2; from 5.2.0 before 5.2.2.1 | NVD |
debian debian_linux debian:debian_linux | 8.0 | NVD |
redhat cloudforms redhat:cloudforms | 4.7; 4.6 | NVD |
opensuse leap opensuse:leap | 15.0 | NVD |
fedoraproject fedora fedoraproject:fedora | 30 | NVD |
redhat software_collections redhat:software_collections | 1.0 | NVD |
References
- https://www.exploit-db.com/exploits/46585/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- http://www.openwall.com/lists/oss-security/2019/03/22/1mailing-list, x-refsource-mlist, mitigation, patch, third-party-advisory
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/x-refsource-confirm, broken-link, patch, vendor-advisory
- https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Qx-refsource-confirm, permissions-required
- https://lists.debian.org/debian-lts-announce/2019/03/msg00042.htmlmailing-list, x-refsource-mlist, third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:0796vendor-advisory, x-refsource-redhat, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/vendor-advisory, x-refsource-fedora, third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:1149vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:1147vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:1289vendor-advisory, x-refsource-redhat, third-party-advisory
- https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/patch, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5418us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.