CVE-2019-5418

What Is Ruby on Rails?

Ruby on Rails is one of the most widely used web application frameworks, powering everything from startups to large-scale platforms. Action View is the templating/rendering layer of Rails responsible for turning controller data into HTML (or other formats) sent to the browser — a component that, if it can be tricked into rendering the wrong thing, becomes a path to leaking server-side files.

Overview

CVE-2019-5418 is a file content disclosure vulnerability (CWE-22, Path Traversal) in Rails' Action View component. Applications that use render file: with dynamic, unsanitized path segments can be manipulated via a specially crafted Accept HTTP header to have Rails render and return the contents of arbitrary files on the server — including sensitive files such as application source code, credentials files, or configuration containing secrets. CVSS score: 7.5, with impact limited to confidentiality (file read) rather than code execution.

Technical Details

The bug exploits how Rails determines the format/extension to render based on the request's Accept header when combined with certain uses of render file:. By manipulating the Accept header to include unexpected values, an attacker can influence which file extension Rails appends when resolving the file path passed to render file:, and in combination with path traversal sequences, cause Rails to read and return a file outside the intended views directory. Because render file: is a relatively niche, explicit method (not the default render call most Rails views use), the vulnerability primarily affects applications that pass user-influenced or dynamic values into it — a pattern more common in custom or legacy Rails code than in typical scaffolded applications.

Discovery

This vulnerability was disclosed and patched by the Ruby on Rails core team as part of its coordinated security release process on March 13, 2019, alongside other framework security fixes released the same day.

Exploitation Context

CISA added this vulnerability to the KEV catalog in July 2025, more than six years after original disclosure — indicating it is still being actively exploited today, most likely against long-lived, unpatched Rails applications built with vulnerable coding patterns from that era. This reflects a broader trend: web framework path-traversal bugs from years past continue to be scanned for and exploited against applications that were never upgraded past known-vulnerable Rails versions.

Remediation

1. Upgrade Rails to the patched versions from the March 2019 security release (Rails 6.0.0.beta3, 5.2.2.1, 5.1.6.2, and 4.2.11, or any later release) — treat any Rails version older than these as vulnerable.
2. Audit application code for uses of render file: with dynamic or user-influenced path segments, and refactor to use safer rendering methods (render template:, render partial:) wherever possible.
3. Validate and allowlist any values that influence file paths or extensions before passing them into rendering calls.
4. Restrict file system permissions for the application process so that even a successful traversal cannot reach highly sensitive files (credentials, private keys) outside the application directory.
5. Review application logs for requests with anomalous Accept headers combined with path traversal sequences, which may indicate exploitation attempts.