The view_component framework for Ruby on Rails versions >= 3.0.0 and < 4.9.0 contains a partial string comparison vulnerability (CWE-187) in its system test entrypoint. It canonicalizes a user-supplied file path using File.realpath and then checks if the resolved path starts with the temporary directory path to enforce containment. However, this check is insufficient because sibling directories may share the same prefix string, leading to an unsafe containment verification. This flaw can be exploited to bypass intended directory restrictions. The vulnerability is addressed in version 4.9.0 of view_component.

The vulnerability allows an attacker to potentially bypass directory containment checks by exploiting the partial string comparison logic. This could lead to unauthorized access to files outside the intended temporary directory scope. The CVSS score of 5.9 (medium severity) reflects a network attack vector with high confidentiality impact but requires high attack complexity and no privileges or user interaction. There are no known exploits in the wild at this time.

This vulnerability is fixed in view_component version 4.9.0. Users of affected versions (>= 3.0.0 and < 4.9.0) should upgrade to version 4.9.0 or later to remediate this issue. Patch status is not explicitly stated beyond the fix in 4.9.0, so upgrading to this version is the recommended remediation.