CVE-2026-44837: view_component Sibling Directory Escape Vulnerability
Summary
CVE-2026-44837: view_component: System Test Entry Point Path Check Allows Sibling Directory Escape. Affects view_component versions >= 3.0.0, < 4.9.0. Fixed in 4.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The view_component package is a Ruby library designed for building reusable view components in Rails applications. It enhances the modularity and maintainability of the UI by allowing developers to create components that encapsulate their own logic and presentation. However, a recent vulnerability has been discovered that allows for potential directory traversal attacks, which could lead to unauthorized file access.
Vulnerability Detail
The vulnerability arises from the way the system test entry point canonicalizes user-controlled file paths using File.realpath. It checks if the resolved path starts with the temp directory path, but this containment check is flawed. Sibling directories can share the same string prefix, allowing an attacker to escape the intended directory and access files outside of it. This could lead to sensitive information disclosure or unauthorized file manipulation, especially in environments where test routes are exposed.
How To Fix
Latest published version: 4.19.0 as of 23 Oct 2026
gem install view_component -v 4.19.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.9.0
This is the first release that contains the fix.
gem install view_component -v 4.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a stricter check for file paths by requiring a separator boundary. For example:
allowed_prefix = "#{base_path}#{File::SEPARATOR}"
unless @path == base_path || @path.start_with?(allowed_prefix)
raise ViewComponent::SystemTestControllerNefariousPathError
end
Conclusion
The CVE-2026-44837 vulnerability in the view_component package poses a risk of unauthorized file access due to improper path validation. It is crucial to update to the patched version and implement recommended code changes to secure your application.
See every vulnerability recorded for view_component →
FAQ
CVE-2026-44837 is a vulnerability in the view_component package that allows for sibling directory escape, potentially leading to unauthorized file access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
You can update the view_component package by running 'gem update view_component' in your terminal.
If you cannot update the package immediately, implement the suggested workaround to enhance path validation and mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for view_component.
