CVE-2026-44837

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-187

Affected software

Vendor	Product	Versions
ViewComponent	view_component	>= 3.0.0, < 4.9.0

References

https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vpExploit, Mitigation, Vendor Advisory
https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vpExploit, Mitigation, Vendor Advisory

Timeline

Published: May 26, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-448388.1RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using CVE-2026-448394.8RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.CVE-2026-44848.8The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the CVE-2026-448407.5Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerabl CVE-2026-448438.2LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code CVE-2026-448446.3eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-448456.7JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated adminis CVE-2026-448466.2JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.in CVE-2026-448477.5MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id})CVE-2026-448488.8Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448498.8Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-44856.3A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin