What’s Vulnerable › Vulnerabilities

CVE-2026-44837: view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-26 · updated 2026-07-24
• Weakness: CWE-187

Description

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.

Affected products

• ViewComponent view_component: from 3.0.0 before 4.9.0 — fixed in 4.9.0

How to fix

Upgrade to a fixed version: ViewComponent view_component 4.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp
• https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp

Get alerted when CVE-2026-44837 or the next vulnerability affects your stack