CVE-2019-5418
Rails Ruby on Rails Path Traversal Vulnerability
Description
CVE-2019-5418 is a high-severity file content disclosure vulnerability in Ruby on Rails Action View, the template rendering component of the Rails web framework. The vulnerability allows an unauthenticated remote attacker to read arbitrary files from the server by sending specially crafted HTTP Accept headers, potentially exposing source code, configuration files, database credentials, and encryption keys. With a CVSS v3.1 score of 7.5, this path traversal flaw affects Rails versions 3.x through 5.2.x and has been actively exploited in the wild. CISA added CVE-2019-5418 to the Known Exploited Vulnerabilities catalog with a deadline of July 28, 2025, and its EPSS score of 94.34% at the 99.95th percentile makes it one of the most exploited Rails vulnerabilities ever disclosed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| rubyonrails | rails | >= 3.0.0, < 4.2.11.1; >= 5.0.0, < 5.0.7.2; >= 5.1.0, < 5.1.6.2; >= 5.2.0, < 5.2.2.1 |
| debian | debian linux | 8.0 |
| redhat | cloudforms | 4.7; 4.6 |
| opensuse | leap | 15.0 |
| fedoraproject | fedora | 30 |
| redhat | software collections | 1.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2019/03/22/1(Mailing List, Mitigation, Patch, Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2019:0796(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2019:1147(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2019:1149(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2019:1289(Third Party Advisory)
- https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q(Permissions Required)
- https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/(Third Party Advisory)
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/(Broken Link, Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/46585/(Exploit, Third Party Advisory, VDB Entry)
- https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5418(US Government Resource)
Weakness Type
CWE-22: Path Traversal
CVE-2019-5418 is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). In the Rails Action View rendering engine, the accept header parsing logic fails to properly restrict file path resolution, allowing an attacker to use directory traversal sequences to access files outside the intended template directories on the server.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
The impact of CVE-2019-5418 is severe for confidentiality, as it enables direct file system access on any vulnerable Rails application server. The attack is remotely exploitable (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality impact is high (C:H) because an attacker can read any file accessible to the Rails application process, including application source code, database configuration files (database.yml), environment files containing API keys and secrets, SSL certificates, and the Rails master key used for encrypting credentials. The EPSS score of 94.34% at the 99.95th percentile confirms near-universal exploitation activity. While integrity and availability are not directly impacted, the disclosed credentials and secrets typically enable follow-on attacks including database compromise, API abuse, and full server takeover. The widespread deployment of Rails applications across startups, enterprises, and SaaS platforms amplifies the total risk surface.
Exploit Maturity
CVE-2019-5418 has reached full exploit maturity with multiple public exploits available. Exploit code is published on Packet Storm Security and Exploit-DB, providing ready-to-use proof-of-concept code for arbitrary file disclosure. CISA has confirmed active exploitation by adding CVE-2019-5418 to the KEV catalog. The EPSS score of 94.34% at the 99.95th percentile indicates this is among the most frequently exploited vulnerabilities globally. The exploitation technique is straightforward — an attacker simply crafts an HTTP Accept header containing a path traversal sequence to read server files — requiring no specialized tools or complex exploit chains. Despite being disclosed in March 2019, unpatched Rails applications continue to be discovered and exploited, particularly in legacy deployments and containerized environments that have not been rebuilt with updated base images.
Remediation
-
Upgrade Ruby on Rails to a patched version immediately. Update to Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, or 5.2.2.1 or later. The Rails security announcement provides detailed upgrade instructions for each affected branch.
-
Implement Accept header validation at the web server or reverse proxy level as an immediate mitigation. Configure your web server (Nginx, Apache) or WAF to reject HTTP requests with Accept headers containing path traversal sequences such as
../,..%2f, or absolute file paths like/etc/passwd. -
Audit exposed secrets and rotate credentials. If the application was running a vulnerable Rails version while internet-facing, assume that configuration files including database.yml, secrets.yml, and master.key have been read. Rotate all database passwords, API keys, encryption keys, and service account credentials.
-
Review application and web server access logs for requests with unusual Accept headers, particularly those containing file path patterns, directory traversal sequences, or references to system files. These are indicators of exploitation attempts.
-
Containerize Rails deployments with minimal file system access by running the application as a non-root user with restricted file permissions and using read-only file systems where possible to limit the impact of future file disclosure vulnerabilities.
Technical Details
CVE-2019-5418 is a file content disclosure vulnerability in the Action View component of Ruby on Rails, with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflecting network-accessible exploitation with no prerequisites and high confidentiality impact. The vulnerability exists in how Action View resolves template files based on the HTTP Accept header. When a Rails controller renders a response, it uses the Accept header to determine the appropriate template format. The rendering engine's file lookup mechanism fails to sanitize path traversal sequences in the format specifier, allowing an attacker to craft an Accept header like ../../../../../../etc/passwd{{ that causes the template resolver to traverse outside the application's view directory and read arbitrary files from the file system. The contents of the requested file are then returned in the HTTP response body, rendered as if they were a template. This affects Action View in Rails versions 3.0.0 through 4.2.11, 5.0.0 through 5.0.7.1, 5.1.0 through 5.1.6.1, and 5.2.0 through 5.2.2. The fix implements proper validation of the Accept header format specifier to prevent directory traversal and restricts template resolution to the application's designated view paths.
Frequently Asked Questions
Is CVE-2019-5418 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2019-5418 and added it to the KEV catalog. The EPSS score of 94.34% at the 99.95th percentile indicates it is one of the most widely exploited vulnerabilities. Public exploit code has been available since 2019.
What products are affected by CVE-2019-5418?
Ruby on Rails versions 3.0.0 through 4.2.11, 5.0.0 through 5.0.7.1, 5.1.0 through 5.1.6.1, and 5.2.0 through 5.2.2 are affected. Additionally, Red Hat CloudForms 4.6 and 4.7, Debian Linux 8.0, openSUSE Leap 15.0, and Fedora 30 ship vulnerable Rails versions.
How do I fix CVE-2019-5418?
Upgrade to Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, or 5.2.2.1 or later. As an immediate mitigation, configure your reverse proxy or WAF to block requests with Accept headers containing path traversal sequences.
How severe is CVE-2019-5418?
With a CVSS score of 7.5 (High) and an EPSS score of 94.34% at the 99.95th percentile, this is an extremely high-risk vulnerability. It enables unauthenticated file disclosure that can expose credentials and secrets, leading to full application and database compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.