29 matches found
CVE-2019-5418
CVE-2019-5418 - Rails 中的文件内容泄露 编辑注 ：此 CVE 可能导致远程代码执行，更多信息：https://github.com/mpgn/Rails-doubletap-RCE Action View 中存在一个可能的文件内容泄露漏洞。 特制的 Accept 头与对 render file: 的调用相结合， 可导致目标服务器上的任意文件被渲染， 从而泄露文件内容。 影响仅限于在未指定 accept 格式时渲染文件内容的 render 调用。 控制器中受影响的代码 大致如下： 由 GitHub 的 John Hawthorn 发现 技术分析 ：...
CVE-2019-5418
CVE-2019-5418 1. 脆弱性の説明 Ruby on RailsはWebアプリケーションフレームワークであり、比較的新しいフレームワークで、Ruby言語上に構築されています。この脆弱性は主に、Ruby on Railsが指定されたパラメータのrender fileを使用してアプリケーション外のビューをレンダリングすることに起因します。特定のコントローラにアクセスするリクエストパケットを変更し、「…/…/…/…/」を使用してパストラバーサルを達成し、次に「」を使用してテンプレートクエリパスを閉じることにより、対象のファイルが外部テンプレートとして解析されるようにします。 3...
Local File Inclusion
Yii 2 is vulnerable to local file inclusion LFI. The vulnerability is due to improper handling of user-controlled parameters in View::renderPhpFile, where the file parameter can overwrite the internal file path before inclusion, allowing attackers to include arbitrary local files and potentially...
CVE-2026-39859
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile and parseFile, but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty...
CVE-2026-39859 LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile and parseFile, but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty...
CVE-2026-39859
The LiquidJS template engine, a pure JavaScript library compatible with Shopify and GitHub Pages, contains a vulnerability in versions prior to 10.25.3 . The issue stems from a failure to enforce directory boundaries during top-level file loads, even though the renderFile() and parseFile() functi...
CVE-2026-39859 LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, liquidjs 10.25.0 documents root as constraining filenames passed to renderFile and parseFile, but top-level file loads do not enforce that boundary. A Liquid instance configured with an empty...
GHSA-V273-448J-V4QJ LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
liquidjs 10.25.0 documents root as constraining filenames passed to renderFile and parseFile, but top-level file loads do not enforce that boundary. The published npm package [email protected] on Linux 6.17.0 with Node v22.22.1. A Liquid instance configured with an empty temporary directory as roo...
PT-2026-31354
liquidjs 10.25.0 documents root as constraining filenames passed to renderFile and parseFile, but top-level file loads do not enforce that boundary. The published npm package [email protected] on Linux 6.17.0 with Node v22.22.1. A Liquid instance configured with an empty temporary directory as roo...
CVE-2025-13842 Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure
The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $REQUEST'postid' parameter without verification in the...
rubygem-actionpack: render file directory traversal in Action View
A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to 'render file:', can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain...
rubygem-actionpack: render file directory traversal in Action View
A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to 'render file:', can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain...
rubygem-actionpack: render file directory traversal in Action View
A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to 'render file:', can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain...
rubygem-actionpack: render file directory traversal in Action View
A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to 'render file:', can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain...
The vulnerability of the Action View component of the Ruby on Rails software platform, allowing attackers to read arbitrary files
The vulnerability of the Action View component in the Ruby on Rails software framework is related to errors in handling HTTP headers “Accept” when used in the “render file” handler code. Exploiting this vulnerability allows an attacker to read arbitrary files...
Ruby on Rails Arbitrary File Read Vulnerability
Ruby on Rails is a very productive, high-maintenance, easy-to-deploy Ruby on Rails Ruby on Rails is a very productive, high-maintenance, and easy-to-deploy web development framework developed using Ruby, and is one of the preferred frameworks for web application development worldwide. Ruby on Rai...
Exploit for Path Traversal in Rubyonrails Rails
CVE-2019-5418 - File Content Disclosure on Rails EDIT: th...
Information Disclosure
actionpack is vulnerable to information disclosure. A remote attacker is able to retrieve arbitrary files on the target server when sending malicious Accept headers that are parsed with render file:...