https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T01:43:43.065093+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-22860 CVE-2026-22860 — Rack has a Directory Traversal via Rack:Directory 2026-10-03T01:43:43.097497+00:00

Affected: rack, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

 https://vulnerability.circl.lu/vuln/usn-8066-1 USN-8066-1 — ruby-rack vulnerabilities 2026-10-03T01:43:43.097656+00:00

Affected: Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack, Ubuntu:25.10: ruby-rack

Minh Pham Quang discovered that Rack did not correctly handle parsing certain paths, which could lead to a path traversal attack. An attacker could possibly use this issue to leak sensitive information. (CVE-2026-22860)

Ali Firas discovered that Rack did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-25500)