CVE-2026-44836
Path Traversal in ViewComponent Preview Routes
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| viewcomponent | view_component | to 4.9.0 (inc) |
| viewcomponent | view_component | From 3.0.0 (inc) to 4.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-749 | The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the view_component framework for Ruby on Rails versions 3.0.0 to 4.9.0. It occurs because the preview route derives an example name from the URL and calls it using public_send without verifying that the requested method is explicitly defined as a preview example. This allows inherited public methods on ViewComponent::Preview, such as render_with_template, to be accessible via routes.
The render_with_template method accepts parameters like template: and locals:, which can come from request parameters and are passed to Rails as render template:. This means that if previews are exposed, an attacker can render internal Rails templates that are not normally accessible through routes.
This vulnerability was fixed in version 4.9.0 of the view_component framework.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to render internal Rails templates that are not intended to be publicly accessible. By exploiting this, an attacker might gain access to sensitive information or internal views that could reveal application logic or data.
Since the vulnerability allows rendering of internal templates via crafted requests, it can lead to information disclosure, which is reflected in the CVSS score indicating high confidentiality impact.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in version 4.9.0 of the view_component framework. Immediate mitigation involves upgrading the view_component gem to version 4.9.0 or later.
If upgrading is not immediately possible, ensure that preview routes are not exposed to untrusted users, as the vulnerability allows attackers to render internal Rails templates via crafted requests.