CVE-2026-44837: falha de média gravidade em ViewComponent view_component
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.4%
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
ViewComponent · view_componentCVEs relacionadas — ViewComponent view_component
No mesmo produto, das mais perigosas para as menos.
CVE-2024-21636MEDIUMview_component Cross-site Scripting vulnerabilityEPSS 0.5%CVE-2026-54498HIGHview_component: around_render HTML-Safety BypassEPSS 0.5%CVE-2026-44836MEDIUMview_component: Preview Route Can Dispatch Inherited Helper MethodsEPSS 0.3%CVE-2026-54497MEDIUMview_component: Reused Component Instances Retain Stale Render ContextEPSS 0.3%