CVE-2019-5418

Confirmed PUBLISHED

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted...

Rails · https://github.com/rails/rails

1 day faster than CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.5 High EPSS 98.5%

At a Glance

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

cisa nuclei_scanner ruby

CVE Published: Mar 27, 2019
Exploitation Reported: Jun 01, 2026
CVSS: 7.5 High
EPSS: 98.5%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Rails	https://github.com/rails/rails	5.2.2.1	Affected
Rails	https://github.com/rails/rails	5.1.6.2	Affected
Rails	https://github.com/rails/rails	5.0.7.2	Affected
Rails	https://github.com/rails/rails	4.2.11.1	Affected

CVE References

RHSA-2019:0796 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:0796
openSUSE-SU-2019:1344 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011...
FEDORA-2019-1cfe24db5c lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
RHSA-2019:1149 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:1149
RHSA-2019:1147 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:1147

Show 7 more references

RHSA-2019:1289 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:1289
46585 exploit-db.com · Exploit https://www.exploit-db.com/exploits/46585/
[oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2019/03/22/1
[debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Cont... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-Fil...
weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-re... weblog.rubyonrails.org · CVE Record https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-b...
groups.google.com/forum groups.google.com · CVE Record https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI9...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2026-06-01 10:36 UTC
CISA	2026-06-02 14:07 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5418.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 5.0 Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitation Status

Exploited in the wild

Recorded 2026-06-01 13:30:38 UTC · CISA

Proof of concept available

Recorded 2019-03-16 11:58:18 UTC · GitHub

Weaknesses (CWE)

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5418.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

daehyeok0618/CVE-2019-5418

github · Created 2025-04-07 16:55:22 UTC · 0 stars

WHS 3기 장대혁 취약한(CVE) Docker 환경 구성 과제입니다.

kailing0220/CVE-2019-5418

github · Created 2022-10-17 09:04:43 UTC · 2 stars

Ruby on Rails是一个 Web 应用程序框架,是一个相对较新的 Web 应用程序框架，构建在 Ruby 语言之上。这个漏洞主要是由于Ruby on Rails使用了指定参数的render file来渲染应用之外的视图，我们可以通过修改访问某控制器的请求包，通过“…/…/…/…/”来达到路径穿越的目的，然后再通过“{{”来进行模板查询路径的闭合，使得所要访问的文件被当做外部模板来解析。

random-robbie/CVE-2019-5418

github · Created 2019-11-19 09:40:06 UTC · 5 stars

takeokunn/CVE-2019-5418

github · Created 2019-03-30 07:40:11 UTC · 2 stars

brompwnie/CVE-2019-5418-Scanner

github · Created 2019-03-19 15:38:01 UTC · 35 stars

A multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418

omarkurt/CVE-2019-5418

github · Created 2019-03-18 16:09:13 UTC · 5 stars

File Content Disclosure on Rails Test Case - CVE-2019-5418

mpgn/CVE-2019-5418

github · Created 2019-03-16 11:58:18 UTC · 195 stars

CVE-2019-5418 - File Content Disclosure on Ruby on Rails

Rails File Content Disclosure

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2019-5418

{
  "cve_id": "CVE-2019-5418",
  "title": "There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5....",
  "affected_vendor": "Rails",
  "affected_product": "https://github.com/rails/rails",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "epss_score": 0.98507,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2019-5418

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API