CVE-2019-5418

KEVHIGH 7.5EPSS 98.5%

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
CVSS v2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 98.51% chance of exploitation in the next 30 days, 100th percentile
CISA KEV: added 2025-07-07
Nuclei: high
Published: 2019-03-27
Updated: 2025-10-21

Proof-of-concept exploits (10)

http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure…
http://www.openwall.com/lists/oss-security/2019/03/22/1
NotoriousRebel/RailRoadBandit3★ · 2019-04-08
daehyeok0618/CVE-2019-54180★ · 2025-04-07
kailing0220/CVE-2019-54182★ · 2022-10-17
mpgn/CVE-2019-5418201★ · 2021-04-05
mpgn/Rails-doubletap-RCE132★ · 2023-01-19
omarkurt/CVE-2019-54185★ · 2019-03-18
random-robbie/CVE-2019-54185★ · 2019-11-19
ztgrace/CVE-2019-5418-Rails30★ · 2023-07-13

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5418.yaml

Metasploit modules (1)

rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/rails_doubletap_file_rea…

ExploitDB entries (1)

https://www.exploit-db.com/exploits/46585

Vulhub environments (1)

vulhub/vulhub/tree/master/rails/CVE-2019-5418

Exploit collections (1)

zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2019/CVE-2019-5418.yaml