CVE catalog
CVE-2026-44837
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file p
- Severity
- Medium · CVSS 5.9
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.41% · Oct 25, 2026
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ruby-view-component | sid | 4.16.0-1 | fixed |
| Debian | ruby-view-component | forky | 4.16.0-1 | fixed |
| Debian | ruby-view-component | bookworm | 2.74.1-1 | vulnerable |
| Cpe | ruby-view-component | Not reported | Not reported | vulnerable |
| Cpe | view_component | Not reported | 4.9.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ruby-view-component | source | sid | 4.12.0-1 | not yet assigned | Not reported | [1138259] |
| Debian | ruby-view-component | source | forky | 4.12.0-1 | not yet assigned | Not reported | [1138259] |
| Debian | ruby-view-component | source | bookworm | (unfixed) | not yet assigned | Not reported | [1138259] |
| Cpe | view_component | cpe | Not reported | 4.9.0 | Not reported | Not reported | Not reported |
Notes
[bookworm] ruby-view-component: Contrib not supported
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ruby-view-component]Affected
Details (2)
2.74.1-1· all · bookwormAffected
nvd · ruby-view-component · debian · bookworm; nvd · ruby-view-component · debian · 12
2.74.1-1· all · bookwormAffected
nvd · ruby-view-component · debian · bookworm; nvd · ruby-view-component · debian · 12
Observed: