https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:50:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-22860 <p><strong>Affected:</strong> rack, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9</p> <p>Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.</p> <p><strong>Affected:</strong> rack, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9</p> <p>Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-22860 https://vulnerability.circl.lu/vuln/ghsa-mxw3-3hh2-x2mh <p><strong>Affected:</strong> RubyGems: rack</p> <p>## Summary</p> <p>`Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root.</p> <p>## Details</p> <p>In `directory.rb`, `File.expand_path(File.join(root, path_info)).start_with?(root)` does not enforce a path boundary. If the server root is `/var/www/root`, a path like `/var/www/root_backup` passes the check because it shares the same prefix, so `Rack::Directory` will list that directory also.</p> <p>## Impact</p> <p>Information disclosure via directory listing outside the configured root when `Rack::Directory` is exposed to untrusted clients and a directory shares the root prefix (e.g., `public2`, `www_backup`).</p> <p>## Mitigation</p> <p>* Update to a patched version of Rack that correctly checks the root prefix. * Don&#39;t name directories with the same prefix as one which is exposed via `Rack::Directory`.</p> <p><strong>Affected:</strong> RubyGems: rack</p> <p>## Summary</p> <p>`Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root.</p> <p>## Details</p> <p>In `directory.rb`, `File.expand_path(File.join(root, path_info)).start_with?(root)` does not enforce a path boundary. If the server root is `/var/www/root`, a path like `/var/www/root_backup` passes the check because it shares the same prefix, so `Rack::Directory` will list that directory also.</p> <p>## Impact</p> <p>Information disclosure via directory listing outside the configured root when `Rack::Directory` is exposed to untrusted clients and a directory shares the root prefix (e.g., `public2`, `www_backup`).</p> <p>## Mitigation</p> <p>* Update to a patched version of Rack that correctly checks the root prefix. * Don&#39;t name directories with the same prefix as one which is exposed via `Rack::Directory`.</p> https://vulnerability.circl.lu/vuln/ghsa-mxw3-3hh2-x2mh