Path prefix check bypass allows sibling directory escape in ViewComponent (CVE-2026-44837)

The system test entrypoint in ViewComponent canonicalizes a user-supplied file path with `File.realpath` and then validates it using `String#start_with?` against the temp directory path. Because sibling directories can share the same string prefix (e.g., `tmp/view_components_evil` starts with `tmp/view_components`), an attacker can craft a path that escapes the intended temp directory and cause Rails to render arbitrary files accessible to the process. The route is mounted only when `Rails.env.test?` is true, but the issue is exploitable in shared CI, staging, review apps, or any deployment where test-mode routes are reachable. Affected versions: - >= 3.0.0 We recommend updating to: 4.9.0. CVSS 7.5 · our assessment: this_week Reference: https://github.com/ViewComponent/view_component/security/advisories/GHSA-hg3h-g7xc-f7vp Details: https://vuln.today/cve/CVE-2026-44837