CVE-2026-44837
CVE-2026-44837 is a medium-severity vulnerability in Viewcomponent View Component with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-187.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- EPSS exploit prediction: 0% (33rd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-31971
- Weakness: CWE-187
- Affected product: Viewcomponent View Component
- Published:
- Last modified:
Description
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.
Frequently asked questions
- What is CVE-2026-44837?
- view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.
- How severe is CVE-2026-44837?
- CVE-2026-44837 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-44837 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-44837?
- CVE-2026-44837 affects Viewcomponent View Component. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-44837?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-44837 have an EU (EUVD) identifier?
- Yes. CVE-2026-44837 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31971.
- When was CVE-2026-44837 published?
- CVE-2026-44837 was published on 2026-05-26 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:viewcomponent:view_component:*:*:*:*:*:ruby:*:*
More vulnerabilities in Viewcomponent View Component
- CVE-2024-21636 — Medium (CVSS 6.1): view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.…
All CVEs affecting Viewcomponent View Component →
Other CWE-187 vulnerabilities
- CVE-2024-41110 — Critical (CVSS 9.9): Moby is an open-source project created by Docker for software containerization. A security vulnerability has been…
- CVE-2022-31802 — Critical (CVSS 9.8): In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared…
- CVE-2026-34785 — High (CVSS 7.5): Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines…
- CVE-2026-45692 — Medium (CVSS 5.4): Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and…
- CVE-2026-14687 — Medium (CVSS 5.3): A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the…
- CVE-2025-23384 — Low (CVSS 3.7): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1),…