view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 26, 2026 · NIST NVD

   Detected

   view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. Th

2. Jul 24, 2026 · NIST NVD

   Updated

   view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. Th

Affected

• cpe viewcomponent/view componentversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-44837

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-44837

  view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the te

  nvd.nist.gov

References

• Exploit · github.com