CVE-2026-44837

The record

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.

Affected packages

Related vulnerabilities

• CVE-2026-84376 Astro is a web framework for content-driven websites. CWE-187
• CVE-2026-62750 Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker… CWE-187
• CVE-2026-14687 A vulnerability was determined in 666ghj BettaFish up to 1.2.1. CWE-187
• CVE-2026-45692 Caddy is an extensible server platform that uses TLS by default. CWE-187
• CVE-2026-55602 http-proxy-middleware is node.js http-proxy middleware. CWE-187
• GHSA-64mm-vxmg-q3vj http-proxy-middleware `router` host+path substring matching allows Host-header-driven… CWE-187
• CVE-2026-35031 Jellyfin is an open source self hosted media server. CWE-187
• CVE-2026-34785 Rack is a modular Ruby web server interface. CWE-187