Name: CVE-2019-5418: Improper Limitation of a Pathname to a Restricted Directory
Creator: Rapid7
Published: 2019-03-27T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2019-5418, CWE-22, Exploited in the Wild, CISA KEV Exploit, Metasploit Module, CVSS 7.5, EPSS 0.94336, CISA KEV

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade rails	Apr 1, 2019	Mar 27, 2019
Freebsd	—	Upgrade rubygem-actionview4Upgrade rubygem-actionview50Upgrade rubygem-actionview5	Mar 19, 2019	Mar 18, 2019
Ruby_on_rails	—	Upgrade to the latest version of Ruby on Rails	Jan 3, 2020	Mar 27, 2019
Suse	—	Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade rmt-serverUpgrade rmt-server-pubcloudUpgrade rmt-server-configUpgrade ruby2.5-rubygem-actionpack-doc-5_1	May 9, 2019	Mar 13, 2019
Ubuntu	—	Upgrade ruby-actionview (Ubuntu Pro)Upgrade ruby-actionpack (Ubuntu Pro)Upgrade rails (Ubuntu Pro)	Jun 26, 2025	Mar 27, 2019

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence