PT-2026-39303 · Debian+3 · Ruby-View-Component+1

Cyberlanc3R · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions view component versions 3.0.0 through 4.8.9

Description The system test entrypoint canonicalizes a user-controlled file path using File.realpath and verifies if the resolved path starts with the temporary directory path. This containment check is insufficient because sibling directories sharing the same string prefix can bypass the validation. An attacker can use the file parameter in the '/ system test entrypoint' endpoint to access and render files located in sibling directories outside the intended temporary directory. This issue is specifically scoped to the test route, which is typically mounted only when the environment is set to test mode.

Recommendations Update to version 4.9.0. As a temporary workaround, restrict access to the '/ system test entrypoint' endpoint to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-187

CWE-22

Related Identifiers

CVE-2026-44837

GHSA-HG3H-G7XC-F7VP

Affected Products

Ruby-View-Component

View

References · 10

• 🔥 https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/view_component/CVE-2026-44837.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44837 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-44837 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44837 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44837 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44837 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44837 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hg3h-g7xc-f7vp · Vendor Advisory
• https://github.com/ViewComponent/view_component · Note