CVE-2026-22860 | BDVDB-2026-315933 Detail
rackrack
Description#
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
References#
- https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh
- https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7
- https://access.redhat.com/security/cve/CVE-2026-22860
- https://bugzilla.redhat.com/show_bug.cgi?id=2440737
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22860.json
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.