CVE Watch—

CVE-2019-5418

Rails Ruby on Rails Path Traversal Vulnerability

CVSS

—

No CVSS

EPSS

98.5%

p100

KEV

YES

Jul 7, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

98.5%EPSS · 30 days98.5%

2026-09-162026-10-14

KEV catalog record

Product

Rails / Ruby on Rails

Vulnerability

Rails Ruby on Rails Path Traversal Vulnerability

Added to KEV

Jul 7, 2025

Remediate by

Jul 28, 2025

Known ransomware use

Summary description

Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-5418

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2016-0752—

99.9%

KEV—80Ruby on Rails Directory Traversal Vulnerability—CVE-2014-0130—

99.0%

KEV—80Ruby on Rails Directory Traversal Vulnerability—