CVE-2019-5418: Rails Ruby on Rails Path Traversal Vulnerability

KEV

Analyzed

AliasesUBUNTU-CVE-2019-5418USN-7646-1DEBIAN-CVE-2019-5418+1 more

Published 27-03-2019Last modified 21-10-2025

Vulnerability summary

CVE-2019-5418 is a high (CVSS 7.5) vulnerability in Rails Ruby on Rails. It is known to be exploited: CISA lists it, first on 07-07-2025. EPSS estimates a 98.51% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (07-07-2025)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

98.51%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference, exploit-database, metasploit

Timeline

27-03-2019
PublishedVulnerability first disclosed.
07-07-2025
Added to CISA KEVExploitedRails Ruby on Rails Path Traversal Vulnerability
28-07-2025
CISA remediation dueDeadline passedApply mitigations per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

98.51%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 98.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 07-07-2025
Federal due date: 28-07-2025

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. web.archive.org/web/… nvd.nist.gov/vuln/detail/CVE-2019-5418

Public exploits

3 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databasemultipleUnverified
Rails 5.2.1 - Arbitrary File Content Disclosure
Maturity: poc
MetasploitremoteUnverified
Ruby On Rails File Content Disclosure ('doubletap')
auxiliary/gather/rails_doubletap_file_read
Maturity: poc

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products

rails< 2:5.2.2.1+dfsg-1
debian_linuxEOL8.0

Redhat2 products

cloudforms4.7 | 4.6
software_collections1.0

Fedoraproject1 product

fedoraEOL30

Opensuse1 product

leapEOL15.0

Rails1 product

https://github.com/rails/rails5.2.2.1 | 5.1.6.2 | 5.0.7.2 | 4.2.11.1

RubyGems1 product

actionview≥ 5.2.0, < 5.2.2.1 | ≥ 4.0.0, < 4.2.11.1 | ≥ 5.1.0, < 5.1.6.2 | ≥ 5.0.0, < 5.0.7.2

Rubyonrails1 product

rails≥ 3.0.0, < 4.2.11.1 | ≥ 5.0.0, < 5.0.7.2 | ≥ 5.1.0, < 5.1.6.2 | ≥ 5.2.0, < 5.2.2.1

Ubuntu1 product

rails< 2:4.2.6-1ubuntu0.1~esm2 | < 2:4.2.10-0ubuntu4+esm2

8 vendors · 10 products

References

28 links

www.exploit-db.com/exploits/46585/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
www.openwall.com/lists/oss-security/2019/03/22/1Mailing ListX Refsource MLISTWEBMitigationPatchThird Party Advisory
weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/X Refsource CONFIRMBroken LinkPatchVendor Advisory
groups.google.com/forum/X Refsource CONFIRMWEBPermissions Required
lists.debian.org/debian-lts-announce/2019/03/msg00042.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
access.redhat.com/errata/RHSA-2019:0796Vendor AdvisoryX Refsource REDHATWEBThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAThird Party Advisory
access.redhat.com/errata/RHSA-2019:1149Vendor AdvisoryX Refsource REDHATWEBThird Party Advisory

Show all 28 references

access.redhat.com/errata/RHSA-2019:1147Vendor AdvisoryX Refsource REDHATWEBThird Party Advisory
access.redhat.com/errata/RHSA-2019:1289Vendor AdvisoryX Refsource REDHATWEBThird Party Advisory
web.archive.org/web/…PatchVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5418Government ResourceWEBUS Government Resource
ubuntu.com/security/CVE-2019-5418REPORT
www.openwall.com/lists/oss-security/2019/03/13/5REPORT
www.cve.org/CVERecord?id=CVE-2019-5418REPORT
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
ubuntu.com/security/notices/USN-7646-1Advisory
security-tracker.debian.org/tracker/CVE-2019-5418Advisory
nvd.nist.gov/vuln/detail/CVE-2019-5418Advisory
groups.google.com/forum/WEB
groups.google.com/forum/WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
web.archive.org/web/…WEB
weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-releasedWEB
www.exploit-db.com/exploits/46585WEB