Path Traversal Vulnerability in ViewComponent Framework by Ruby on Rails
CVE-2026-44837

5.9MEDIUM

Key Information:

Vendor

Viewcomponent

Status
View Component
Vendor
CVE Published:
26 May 2026

What is CVE-2026-44837?

The ViewComponent framework in Ruby on Rails contains a path traversal vulnerability where user-controlled file paths are improperly canonicalized. During the system test entrypoint, the use of File.realpath allows an attacker to manipulate directory paths due to the lack of safe containment checks. This flaw potentially permits access to unauthorized file system locations. The issue has been addressed in version 4.9.0, advising users to upgrade their components to enhance security.

Affected Version(s)

view_component >= 3.0.0, < 4.9.0

References

https://github.com/ViewComponent/view_component/security/...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.