# CVE-2026-44837: ViewComponent path traversal in system test entrypoint

Source: https://junglewise.ai/threats/cve-2026-44837-viewcomponent-path-traversal-in-system-test-entrypoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44837 · Severity: medium · CVSS 5.9 · Published 2026-05-26

ViewComponent is a framework for building reusable UI components in Ruby on Rails. A security flaw in its system testing component allows an attacker to access files outside of the intended temporary directory. This could lead to the exposure of sensitive application files if test routes are accidentally accessible in environments like staging or shared CI/CD pipelines.

Technologies: [GitHub ViewComponent](https://junglewise.ai/threats/technologies/viewcomponent), [view_component (RubyGems)](https://junglewise.ai/threats/technologies/view-component). Vendors: [GitHub](https://junglewise.ai/threats/vendors/github), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-44837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44837 being exploited in the wild.

**How severe is CVE-2026-44837?** Medium severity, with a CVSS score of 5.9, published 26 May 2026.

**Which products and versions are affected?** GitHub ViewComponent >= 3.0.0, < 4.9.0; view_component (RubyGems) >= 3.0.0, < 4.9.0, ECOSYSTEM:introduced=3.0.0,fixed=4.9.0.

**Is there a fix for CVE-2026-44837?** Yes. view_component (RubyGems): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44837 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44837?** Check whether you run GitHub ViewComponent or view_component (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- view_component (RubyGems): upgrade to 4.9.0 or later

  ```sh
  bundle update view_component
  ```


## Technical details

A path traversal vulnerability exists in the `ViewComponentsSystemTestController` due to an insecure containment check. The controller uses `File.realpath` to canonicalize a user-provided path and then validates it using `start_with?` against a base directory. Because the check does not ensure the base path ends with a directory separator, an attacker can use '..' to escape to a sibling directory that shares the same string prefix (e.g., accessing `/tmp/view_components_evil/` when only `/tmp/view_components/` is allowed). This allows for arbitrary file read within the scope of the web server's permissions. The vulnerability is primarily reachable when the application is running in the Rails test environment. This issue is fixed in version 4.9.0.

## Affected products

- ViewComponent view_component >= 3.0.0, < 4.9.0

## Identifiers

- CVE-2026-44837
- GHSA-hg3h-g7xc-f7vp

## Timeline

- 2026-05-05: disclosed
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-26: other: NVD published

## References

- [https://api.github.com/users/cyberlanc3r](https://api.github.com/users/cyberlanc3r)
- [https://github.com/cyberlanc3r](https://github.com/cyberlanc3r)
- [https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D](https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D)
- [https://api.github.com/users/cyberlanc3r/repos](https://api.github.com/users/cyberlanc3r/repos)
- [https://avatars.githubusercontent.com/u/216992819?v=4](https://avatars.githubusercontent.com/u/216992819?v=4)
- [https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D](https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D)

## Related threats

- [ViewComponent XSS via around_render HTML-safety bypass](https://junglewise.ai/threats/cve-2026-54498-viewcomponent-xss-via-around-render-html-safety-bypass)
- [ViewComponent stale render context in reused component instances](https://junglewise.ai/threats/cve-2026-54497-viewcomponent-stale-render-context-in-reused-component-instances)
- [ViewComponent unauthorized template rendering in preview route](https://junglewise.ai/threats/cve-2026-44836-viewcomponent-unauthorized-template-rendering-in-preview-route)
- [view_component Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-21636-view-component-cross-site-scripting-vulnerability)
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component](https://junglewise.ai/threats/cve-2022-24722-improper-neutralization-of-input-during-web-page-generation-cross)