Affected: Rails https://github.com/rails/rails

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Affected: RubyGems: actionview

# File Content Disclosure in Action View

Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this:

``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end ```

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this:

``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end ```

In summary, impacted calls to `render` look like this:

``` render file: "#{Rails.root}/some/file" ```

The vulnerability can be mitigated by changing to this:

``` render file: "#{Rails.root}/some/file", formats: [:html] ```

Other calls to `render` are not impacted.

Alternatively, the following monkey pa…