CVE-2026-44837

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp	Exploit Mitigation Vendor Advisory
https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:viewcomponent:view_component:*:*:*:*:*:ruby:*:*

History

No history.

Information

Published : 2026-05-26 21:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-44837

Mitre link : CVE-2026-44837

CVE.ORG link : CVE-2026-44837

JSON object : View

Products Affected

viewcomponent

view_component

CWE

CWE-187

Partial String Comparison

{"id": "CVE-2026-44837", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44837", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T14:03:17.325766Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ViewComponent", "product": "view_component", "versions": [{"status": "affected", "version": ">= 3.0.0, < 4.9.0"}]}]}], "published": "2026-05-26T21:16:38.853", "references": [{"url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-187"}]}], "descriptions": [{"lang": "en", "value": "view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0."}, {"lang": "es", "value": "view_component es un framework para construir componentes de vista reutilizables, testeables y encapsulados en Ruby on Rails. Desde 3.0.0 hasta 4.9.0, el punto de entrada de la prueba del sistema canoniza una ruta de archivo controlada por el usuario con File.realpath, luego verifica si la ruta resuelta comienza con la ruta del directorio temporal. Esta no es una verificaci\u00f3n de contenci\u00f3n segura porque los directorios hermanos pueden compartir el mismo prefijo de cadena. Esta vulnerabilidad est\u00e1 corregida en 4.9.0."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:viewcomponent:view_component:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "E57ADC3B-788F-4E63-9524-8014ECEE31B6", "versionEndExcluding": "4.9.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}