{
  "cveId": "CVE-2019-5418",
  "url": "https://patchblox.com/security/cve/CVE-2019-5418",
  "summary": "CVE-2019-5418 is fixed in 10 products on 1 platform, first by rails 2:4.2.10-0ubuntu4\u002Besm2, released March 27, 2019. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on July 7, 2025. Patch Radar priority: Patch now.",
  "title": "rails: There is a File Content Disclosure vulnerability in Action View \u0026lt;5.2.2.1, \u0026lt;5.1.6.2, \u0026lt;5.0.7.2, \u0026lt;4.2.11.1 a...",
  "description": "There is a File Content Disclosure vulnerability in Action View \u0026lt;5.2.2.1, \u0026lt;5.1.6.2, \u0026lt;5.0.7.2, \u0026lt;4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system\u0027s filesystem to be exposed.",
  "published": "2019-03-27T07:29:00Z",
  "severity": "High",
  "epss": 0.98507,
  "epssPercentile": 0.9992,
  "priority": "Patch now",
  "priorityTier": 1,
  "exploited": true,
  "vendorExploited": false,
  "disclosed": false,
  "kev": {
    "added": "2025-07-07T00:00:00Z",
    "due": "2025-07-28T00:00:00Z",
    "ransomware": false,
    "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
  },
  "fixes": [
    {
      "platform": "linux",
      "product": "rails",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "rails 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-rails-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionmailer",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-actionmailer 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-actionmailer-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionpack",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-actionpack 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-actionpack-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionview",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-actionview 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-actionview-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activejob",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-activejob 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activejob-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activemodel",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-activemodel 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activemodel-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activerecord",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-activerecord 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activerecord-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activesupport",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-activesupport 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activesupport-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rails",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-rails 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-rails-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-railties",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm2",
      "fix": "ruby-railties 2:4.2.10-0ubuntu4\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-railties-2-4.2.10-0ubuntu4-esm2",
      "released": "2019-03-27T07:29:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}