CVE-2013-0262
Rack Vulnerable to Path Traversal
CVE-2013-0262 is a medium vulnerability (CVSS 4.3) in Rack Project Rack, published February 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in rack 1.5.2.
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Exploit likelihood
What each source reports
NVD Score used
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
CVE-2013-0262- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
CVE-2013-0262- Updated
- 2026-11-02
EUVDEUVD-2017-0190 No score
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
EUVD-2017-0190- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-85r7-w5mv-c849 No score
Rack Vulnerable to Path Traversal
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
GHSA-85r7-w5mv-c849- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
CVE-2013-0262- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0262 No score
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
DEBIAN-CVE-2013-0262- Updated
- 2026-11-02
Show 17 moreShow less
OSVGHSA-85r7-w5mv-c849 No score
Rack Vulnerable to Path Traversal
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
GHSA-85r7-w5mv-c849- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10115-1 No score
ruby2.2-rubygem-rack-1_4-1.4.7-1.8 on GA media
These are all security issues fixed in the ruby2.2-rubygem-rack-1_4-1.4.7-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10115-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10406-1 No score
ruby2.2-rubygem-rack-1_6-1.6.5-1.1 on GA media
These are all security issues fixed in the ruby2.2-rubygem-rack-1_6-1.6.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10406-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11344-1 No score
ruby2.7-rubygem-rack-2.2.3-1.7 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rack-2.2.3-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11344-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11345-1 No score
ruby2.7-rubygem-rack-1_6-1.6.13-1.13 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rack-1_6-1.6.13-1.13 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11345-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11346-1 No score
ruby2.7-rubygem-rack-2.0-2.0.9-1.10 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rack-2.0-2.0.9-1.10 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11346-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12119-1 No score
ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-rack-2.2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12119-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12397-1 No score
ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12397-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12974-1 No score
ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rack-2.2-2.2.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12974-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13167-1 No score
ruby3.2-rubygem-rack-3.0.7-1.2 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rack-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13167-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13726-1 No score
ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13726-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13727-1 No score
ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13727-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14811-1 No score
ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14811-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14875-1 No score
ruby3.4-rubygem-rack-3.1.12-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14875-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10286-1 No score
ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10286-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10358-1 No score
ruby4.0-rubygem-rack-3.1.18-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10358-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-0262 No score
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
- Record
UBUNTU-CVE-2013-0262- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rackRubyGems |
1.5.0 up to 1.5.2 | 1.5.2 |
rackRubyGems |
1.4.0 up to 1.4.5 | 1.4.5 |
ruby-rackDebian:12 |
before 1.4.1-2.1 | 1.4.1-2.1 |
ruby-rackDebian:13 |
before 1.4.1-2.1 | 1.4.1-2.1 |
ruby-rackDebian:14 |
before 1.4.1-2.1 | 1.4.1-2.1 |
rackRubyGems |
1.5.0 up to 1.5.2, plus listed versions 1.5.1 |
1.5.2 |
rackRubyGems |
1.4.0 up to 1.4.5, plus listed versions 1.4.11.4.21.4.31.4.4 |
1.4.5 |
ruby193-rubygem-rackRed Hat:openshift:1::el6 |
before 1:1.4.1-4.el6 | 1:1.4.1-4.el6 |
rubygem-rackRed Hat:openshift:1::el6 |
before 1:1.3.0-4.el6op | 1:1.3.0-4.el6op |
jenkinsRed Hat:openshift:1::el6 |
before 0:1.502-1.el6op | 0:1.502-1.el6op |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openshift-origin-cartridge-jenkins-1.4Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
ruby-rackUbuntu:14.04:LTS |
before 1.5.2-1 | 1.5.2-1 |
rubyem-rackopenSUSE:Tumbleweed |
before 1.4.7-1.8 | 1.4.7-1.8 |
rubygem-rackopenSUSE:Tumbleweed |
before 2.2.3.1-1.1 | 2.2.3.1-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.4-1.1 | 2.2.4-1.1 |
ruby3.2-rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.7-1.1 | 2.2.7-1.1 |
ruby3.2-rubygem-rackopenSUSE:Tumbleweed |
before 3.0.7-1.2 | 3.0.7-1.2 |
rubygem-rackopenSUSE:Tumbleweed |
before 3.0.9.1-1.1 | 3.0.9.1-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.8.1-1.1 | 2.2.8.1-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.11-1.1 | 2.2.11-1.1 |
rubygem-rackopenSUSE:Tumbleweed |
before 3.1.12-1.1 | 3.1.12-1.1 |
rubygem-rack-2.2openSUSE:Tumbleweed |
before 2.2.22-1.1 | 2.2.22-1.1 |
rubygem-rackopenSUSE:Tumbleweed |
before 3.1.18-1.3 | 3.1.18-1.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
groups.google.com/forum
gist.github.com/rentzsch/4736940
secunia.com/advisories/52033
rack.github.com
bugzilla.redhat.com/show_bug.cgi?id=909071
github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30
Show 68 moreShow less
lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
nvd.nist.gov/vuln/detail/CVE-2013-0262
security-tracker.debian.org/tracker/CVE-2013-0262
access.redhat.com/errata/RHSA-2013:0638
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0638.json
cve.org/CVERecord?id=CVE-2013-0262
ubuntu.com/security/CVE-2013-0262
openwall.com/lists/oss-security/2013/02/07
suse.com/security/cve/CVE-2013-0262