Executive brief
ViewComponent is a framework for building reusable UI components in Ruby on Rails. A security flaw in its system testing component allows an attacker to access files outside of the intended temporary directory. This could lead to the exposure of sensitive application files if test routes are accidentally accessible in environments like staging or shared CI/CD pipelines.
Technical details
A path traversal vulnerability exists in the `ViewComponentsSystemTestController` due to an insecure containment check. The controller uses `File.realpath` to canonicalize a user-provided path and then validates it using `start_with?` against a base directory. Because the check does not ensure the base path ends with a directory separator, an attacker can use '..' to escape to a sibling directory that shares the same string prefix (e.g., accessing `/tmp/view_components_evil/` when only `/tmp/view_components/` is allowed). This allows for arbitrary file read within the scope of the web server's permissions. The vulnerability is primarily reachable when the application is running in the Rails test environment. This issue is fixed in version 4.9.0.
Affected products
- ViewComponent view_component >= 3.0.0, < 4.9.0
Timeline
- 2026-05-05: disclosed
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-26: other: NVD published