CVE-2026-44837EPSS p33.9%

CVE-2026-44837CVE-2026-44837

viewcomponent / view_component

Description

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.

Scoring

CVSS 5.9 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS0.41% probability of exploitation · percentile 33.9% · 2026-08-03T12:00:16Z
Last modified2026-07-24

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-44836
CVE
Rails Ruby on Rails Path Traversal Vulnerability
CVE
Ruby on Rails Directory Traversal Vulnerability
CVE
CVE-2026-49738
CVE
CVE-2026-23885
CVE
CVE-2026-33195
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.