GHSA-86g5-2wh3-gc9j Path Traversal in Action View

• RubyGems actionview: >= 5.2.0, < 5.2.2.1 → fixed in 5.2.2.1 • RubyGems actionview: >= 4.0.0, < 4.2.11.1 → fixed in 4.2.11.1 • RubyGems actionview: >= 5.1.0, < 5.1.6.2 → fixed in 5.1.6.2 • RubyGems actionview: >= 5.0.0, < 5.0.7.2 → fixed in 5.0.7.2

File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this: ``` ruby class UserController of GitHub