{"id":"CVE-2026-22860","aliases":["DEBIAN-CVE-2026-22860","DLA-4505-1","DSA-6180-1","EUVD-2026-7914","GHSA-mxw3-3hh2-x2mh","MGASA-2026-0075","UBUNTU-CVE-2026-22860","USN-8066-1","openSUSE-SU-2026:10286-1"],"status":"published","title":"Rack has a Directory Traversal via Rack:Directory","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00763,"percentile":0.55808,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-548"],"published":"2026-02-17T16:14:11Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"RubyGems","package":"rack","fixed_in":["2.2.22","3.1.20","3.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rack","fixed_in":["2.2.22-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rack","fixed_in":["3.1.20-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rack","fixed_in":["3.2.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","fixed_in":["2.0.7-2ubuntu0.1+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","fixed_in":["2.1.4-5ubuntu1.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ruby-rack","fixed_in":["2.2.7-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"ruby-rack","fixed_in":["3.1.16-0.1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"ruby-rack","fixed_in":["3.2.4-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ruby-rack","fixed_in":["3.2.4-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0.beta1"},{"fixed":"3.1.20"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-0+deb12u1"}]}],"versions":["2.2.13-1~deb12u1","2.2.20-0+deb12u1","2.2.6.4-1","2.2.6.4-1+deb12u1","2.2.7-1","2.2.7-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.20-0+deb13u1"}]}],"versions":["3.1.16-0.1","3.1.18-1","3.1.18-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1"}]}],"versions":["3.1.16-0.1","3.1.18-1","3.1.18-1~deb13u1","3.2.4-1"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-3+deb11u5"}]}],"versions":["2.1.4-3","2.1.4-3+deb11u1","2.1.4-3+deb11u2","2.1.4-3+deb11u3","2.1.4-3+deb11u4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-0+deb12u1"}]}],"versions":["2.2.13-1~deb12u1","2.2.20-0+deb12u1","2.2.6.4-1","2.2.6.4-1+deb12u1","2.2.7-1","2.2.7-1.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.20-0+deb13u1"}]}],"versions":["3.1.16-0.1","3.1.18-1","3.1.18-1~deb13u1"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.1.1","1.1.1.pre","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.3.0","1.3.0.beta","1.3.0.beta2","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0.beta","1.6.0.beta2","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","2.0.0.alpha","2.0.0.rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.1","2.0.9.2","2.0.9.3","2.0.9.4","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.4.1","2.1.4.2","2.1.4.3","2.1.4.4","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.3","2.2.3.1","2.2.4","2.2.5","2.2.6","2.2.6.1","2.2.6.2","2.2.6.3","2.2.6.4","2.2.7","2.2.8","2.2.8.1","2.2.9"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0.beta1"},{"fixed":"3.1.20"}]}],"versions":["3.0.0","3.0.0.beta1","3.0.0.rc1","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.2","3.0.3","3.0.4","3.0.4.1","3.0.4.2","3.0.5","3.0.6","3.0.6.1","3.0.7","3.0.8","3.0.9","3.0.9.1","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.5"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3","3.2.4"]},{"source":"osv","ecosystem":"Mageia:9","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-1","1.5.2-1ubuntu0.1~esm1","1.5.2-3+deb8u3ubuntu1~esm2","1.5.2-3+deb8u3ubuntu1~esm3","1.5.2-3+deb8u3ubuntu1~esm4","1.5.2-3+deb8u3ubuntu1~esm6","1.5.2-3+deb8u3ubuntu1~esm7","1.5.2-3+deb8u3ubuntu1~esm8","1.5.2-3+deb8u3ubuntu1~esm9","1.5.2-3+deb8u3ubuntu1~esm10","1.5.2-3+deb8u3ubuntu1~esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3","1.6.4-3ubuntu0.1","1.6.4-3ubuntu0.2","1.6.4-3ubuntu0.2+esm1","1.6.4-3ubuntu0.2+esm2","1.6.4-3ubuntu0.2+esm4","1.6.4-3ubuntu0.2+esm5","1.6.4-3ubuntu0.2+esm6","1.6.4-3ubuntu0.2+esm7","1.6.4-3ubuntu0.2+esm8","1.6.4-3ubuntu0.2+esm9","1.6.4-3ubuntu0.2+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.4-4","1.6.4-4ubuntu0.1","1.6.4-4ubuntu0.2","1.6.4-4ubuntu0.2+esm1","1.6.4-4ubuntu0.2+esm2","1.6.4-4ubuntu0.2+esm4","1.6.4-4ubuntu0.2+esm5","1.6.4-4ubuntu0.2+esm6","1.6.4-4ubuntu0.2+esm7","1.6.4-4ubuntu0.2+esm8","1.6.4-4ubuntu0.2+esm9","1.6.4-4ubuntu0.2+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm9"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1","2.0.7-2ubuntu0.1+esm2","2.0.7-2ubuntu0.1+esm3","2.0.7-2ubuntu0.1+esm4","2.0.7-2ubuntu0.1+esm5","2.0.7-2ubuntu0.1+esm6","2.0.7-2ubuntu0.1+esm7","2.0.7-2ubuntu0.1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.2+esm2"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1","2.1.4-5ubuntu1+esm2","2.1.4-5ubuntu1+esm3","2.1.4-5ubuntu1+esm4","2.1.4-5ubuntu1+esm5","2.1.4-5ubuntu1.1","2.1.4-5ubuntu1.1+esm1","2.1.4-5ubuntu1.1+esm2","2.1.4-5ubuntu1.2","2.1.4-5ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu0.6"}]}],"versions":["2.2.4-3","2.2.7-1","2.2.7-1ubuntu0.1","2.2.7-1ubuntu0.2","2.2.7-1ubuntu0.3","2.2.7-1ubuntu0.4","2.2.7-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16-0.1ubuntu0.2"}]}],"versions":["2.2.7-1.1","3.1.16-0.1","3.1.16-0.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1ubuntu1"}]}],"versions":["3.1.16-0.1","3.1.18-1","3.1.18-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm9"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1","2.0.7-2ubuntu0.1+esm2","2.0.7-2ubuntu0.1+esm3","2.0.7-2ubuntu0.1+esm4","2.0.7-2ubuntu0.1+esm5","2.0.7-2ubuntu0.1+esm6","2.0.7-2ubuntu0.1+esm7","2.0.7-2ubuntu0.1+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.2+esm2"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1","2.1.4-5ubuntu1+esm2","2.1.4-5ubuntu1+esm3","2.1.4-5ubuntu1+esm4","2.1.4-5ubuntu1+esm5","2.1.4-5ubuntu1.1","2.1.4-5ubuntu1.1+esm1","2.1.4-5ubuntu1.1+esm2","2.1.4-5ubuntu1.2","2.1.4-5ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu0.6"}]}],"versions":["2.2.4-3","2.2.7-1","2.2.7-1ubuntu0.1","2.2.7-1ubuntu0.2","2.2.7-1ubuntu0.3","2.2.7-1ubuntu0.4","2.2.7-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16-0.1ubuntu0.2"}]}],"versions":["2.2.7-1.1","3.1.16-0.1","3.1.16-0.1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-1.1"}]}],"bundled":27}],"products":[{"vendor":"rack","product":"rack"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22860","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440737","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22860.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22860","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-22860.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mxw3-3hh2-x2mh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22860.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-22860","tags":["advisory"]},{"url":"https://github.com/rack/rack","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0075.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35285","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00089.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-22860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22860","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8066-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-25500","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25500","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-22860","title":"Rack has a Directory Traversal via Rack:Directory","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.","status":"published","published":"2026-02-18T18:45:02.095Z","modified":"2026-07-15T01:18:57.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22","CWE-548","CWE-22"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-7914","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.","status":"published","published":"2026-02-18T18:45:02Z","modified":"2026-07-15T01:18:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-mxw3-3hh2-x2mh","title":"Rack has a Directory Traversal via Rack:Directory","description":"## Summary\n\n`Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root.\n\n## Details\n\nIn `directory.rb`, `File.expand_path(File.join(root, path_info)).start_with?(root)` does not enforce a path boundary. If the server root is `/var/www/root`, a path like `/var/www/root_backup` passes the check because it shares the same prefix, so `Rack::Directory` will list that directory also. \n\n## Impact\n\nInformation disclosure via directory listing outside the configured root when `Rack::Directory` is exposed to untrusted clients and a directory shares the root prefix (e.g., `public2`, `www_backup`).\n\n## Mitigation\n\n* Update to a patched version of Rack that correctly checks the root prefix.\n* Don't name directories with the same prefix as one which is exposed via `Rack::Directory`.","status":"published","published":"2026-02-17T16:14:11Z","modified":"2026-02-24T16:06:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22","CWE-548"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2026-22860","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.","status":"published","published":"2026-02-18T19:21:43.933Z","modified":"2026-07-15T02:18:39.003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-548"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"CVE-2026-22860","title":"Rack has a Directory Traversal via Rack:Directory","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.","status":"published","published":"2026-02-18T18:45:02.095Z","modified":"2026-10-28T02:30:20.66359329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22","CWE-548"],"updated_at":"2026-11-02T15:44:58.749922Z"},{"id":"DEBIAN-CVE-2026-22860","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.","status":"published","published":"2026-02-18T19:21:43.933Z","modified":"2026-10-01T03:02:30.854817199Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"GHSA-mxw3-3hh2-x2mh","title":"Rack has a Directory Traversal via Rack:Directory","description":"## Summary\n\n`Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root.\n\n## Details\n\nIn `directory.rb`, `File.expand_path(File.join(root, path_info)).start_with?(root)` does not enforce a path boundary. If the server root is `/var/www/root`, a path like `/var/www/root_backup` passes the check because it shares the same prefix, so `Rack::Directory` will list that directory also. \n\n## Impact\n\nInformation disclosure via directory listing outside the configured root when `Rack::Directory` is exposed to untrusted clients and a directory shares the root prefix (e.g., `public2`, `www_backup`).\n\n## Mitigation\n\n* Update to a patched version of Rack that correctly checks the root prefix.\n* Don't name directories with the same prefix as one which is exposed via `Rack::Directory`.","status":"published","published":"2026-02-17T16:14:11Z","modified":"2026-09-10T03:50:35.448280027Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22","CWE-548"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"UBUNTU-CVE-2026-22860","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.","status":"published","published":"2026-02-18T19:21:00Z","modified":"2026-10-17T12:59:55.190199053Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"DLA-4505-1","title":"ruby-rack - security update","status":"published","published":"2026-03-23T00:00:00Z","modified":"2026-03-23T00:00:00Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-6180-1","title":"ruby-rack - security update","status":"published","published":"2026-03-26T00:00:00Z","modified":"2026-03-26T22:31:23.149907Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0075","title":"Updated ruby-rack packages fix security vulnerabilities","description":"Rack has a Directory Traversal via Rack:Directory. (CVE-2026-22860)\nRack's Stored XSS in Rack::Directory via javascript: filenames rendered\ninto anchor href. (CVE-2026-25500)\n","status":"published","published":"2026-03-31T23:05:51Z","modified":"2026-04-16T04:43:22.408165615Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10286-1","title":"ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-04T00:00:00Z","modified":"2026-03-23T04:54:39.054152Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"USN-8066-1","title":"ruby-rack vulnerabilities","description":"Minh Pham Quang discovered that Rack did not correctly handle parsing\ncertain paths, which could lead to a path traversal attack. An attacker\ncould possibly use this issue to leak sensitive information.\n(CVE-2026-22860)\n\nAli Firas discovered that Rack did not correctly sanitize certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-25500)","status":"published","published":"2026-02-26T01:07:37Z","modified":"2026-06-30T18:15:32.772326458Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}