Back to the CVE list
CVE-2019-5418 CISA KEV · Actively exploited

Rails Ruby on Rails Path Traversal Vulnerability

CVSS score

—

EPSS probability

%98.5

Risk score

—

Published

1 y ago

OverviewPublic Exploits (10)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
5t1ck/rails-doubletap-py
GitHub

Automated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.

Public PoCSource updated: 13.10.2026 04:25:12
G
CyberCTF/vulhub-rails-cve-2019-5418
GitHub

Vulhub rails/CVE-2019-5418: Ruby on Rails Accept Header File Disclosure (CVE-2019-5418), run with Isoloom

Public PoCSource updated: 10.10.2026 10:43:32
G
daehyeok0618/CVE-2019-5418
GitHub

WHS 3기 장대혁 취약한(CVE) Docker 환경 구성 과제입니다.

Public PoCSource updated: 07.04.2025 17:42:08
G
ztgrace/CVE-2019-5418-Rails3
GitHub

Rails 3 PoC of CVE-2019-5418

Public PoCSource updated: 04.10.2019 19:29:56
G
mpgn/Rails-doubletap-RCE
GitHub

RCE on Rails 5.2.2 using a path traversal (CVE-2019-5418) and a deserialization of Ruby objects (CVE-2019-5420)

Public PoCSource updated: 17.08.2026 13:31:44
G
kailing0220/CVE-2019-5418
GitHub

Ruby on Rails是一个 Web 应用程序框架,是一个相对较新的 Web 应用程序框架，构建在 Ruby 语言之上。这个漏洞主要是由于Ruby on Rails使用了指定参数的render file来渲染应用之外的视图，我们可以通过修改访问某控制器的请求包，通过“…/…/…/…/”来达到路径穿越的目的，然后再通过“{{”来进行模板查询路径的闭合，使得所要访问的文件被当做外部模板来解析。

Public PoCSource updated: 13.01.2023 12:24:23
G
mpgn/CVE-2019-5418
GitHub

CVE-2019-5418 - File Content Disclosure on Ruby on Rails

Public PoCSource updated: 14.11.2025 08:42:56
G
random-robbie/CVE-2019-5418
GitHub

random-robbie/CVE-2019-5418

Public PoCSource updated: 26.04.2021 19:41:51
E
Rails 5.2.1 - Arbitrary File Content Disclosure
Exploit-DB

Rails 5.2.1 - Arbitrary File Content Disclosure

Exploit referenceSource updated: 21.03.2019 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5418.yaml
Nuclei

Nuclei: Rails File Content Disclosure

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2019-5418"