CVE-2019-5418

CVE-2019-5418 is a path traversal vulnerability (CWE-22) in the Action View component of Ruby on Rails. When an application uses calls to 'render file:', a specially crafted Accept header can cause Rails to render arbitrary files on the target server, disclosing their contents to the attacker. Ruby on Rails applications (vendor: Rails) are affected, and the flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-07 and has a 98.5% EPSS probability of exploitation within 30 days (100th percentile).

What to do: Apply mitigations per Rails vendor instructions immediately; organizations subject to BOD 22-01 must follow the applicable guidance for cloud services or discontinue use of the product if mitigations are unavailable. Given the KEV listing and near-certain EPSS probability, prioritize remediation of this issue over routine patch cycles. When scoping impact, review any code paths that combine 'render file:' with user-supplied Accept headers, since this is the pattern that triggers the flaw.