Vulnerability-Lookup

CVE-2026-25500 (GCVE-0-2026-25500)

Vulnerability from cvelistv5 – Published: 2026-02-18 18:59 – Updated: 2026-02-18 19:42

Title

Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Summary

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/rack/rack/security/advisories/…	x_refsource_CONFIRM
https://github.com/rack/rack/commit/f2f225f297b99…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
rack	rack	Affected: < 2.2.22 Affected: >= 3.0.0.beta1, < 3.1.20 Affected: >= 3.2.0, < 3.2.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-18T19:42:04.480536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-18T19:42:35.101Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rack",
          "vendor": "rack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0.beta1, \u003c 3.1.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.2.0, \u003c 3.2.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T18:59:31.964Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp"
        },
        {
          "name": "https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff"
        }
      ],
      "source": {
        "advisory": "GHSA-whrj-4476-wvmp",
        "discovery": "UNKNOWN"
      },
      "title": "Rack\u0027s Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25500",
    "datePublished": "2026-02-18T18:59:31.964Z",
    "dateReserved": "2026-02-02T18:21:42.485Z",
    "dateUpdated": "2026-02-18T19:42:35.101Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-25500",
      "date": "2026-07-03",
      "epss": "0.00224",
      "percentile": "0.12951"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25500\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-18T20:18:36.110\",\"lastModified\":\"2026-06-17T10:24:44.857\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.\"},{\"lang\":\"es\",\"value\":\"Rack es una interfaz modular para servidores web Ruby. Antes de las versiones 2.2.22, 3.1.20 y 3.2.5, `Rack::Directory` generaba un \u00edndice de directorio HTML en el que cada entrada de archivo se representaba como un enlace en el que se pod\u00eda hacer clic. Si existe un archivo en el disco cuyo nombre base comienza con el esquema `javascript:` (por ejemplo, `javascript:alert(1)`), el \u00edndice generado contiene un ancla cuyo `href` es exactamente `javascript:alert(1)`. Al hacer clic en la entrada, se ejecuta JavaScript en el navegador (demostrado con `alert(1)`). Las versiones 2.2.22, 3.1.20 y 3.2.5 corrigen el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"rack\",\"product\":\"rack\",\"versions\":[{\"version\":\"\u003c 2.2.22\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.0.0.beta1, \u003c 3.1.20\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.2.0, \u003c 3.2.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-18T19:42:04.480536Z\",\"id\":\"CVE-2026-25500\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*\",\"versionEndExcluding\":\"2.2.22\",\"matchCriteriaId\":\"58D73D7A-523C-4472-9322-87B5E7A785CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.1.20\",\"matchCriteriaId\":\"76491EC1-2EA1-492E-97B2-2427EDFB0E07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"3.2.0\",\"versionEndExcluding\":\"3.2.5\",\"matchCriteriaId\":\"653A4AF6-055E-46F2-992E-C6624BBF8A25\"}]}]}],\"references\":[{\"url\":\"https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25500\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-18T19:42:04.480536Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-18T19:42:08.407Z\"}}], \"cna\": {\"title\": \"Rack\u0027s Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href\", \"source\": {\"advisory\": \"GHSA-whrj-4476-wvmp\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"rack\", \"product\": \"rack\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.2.22\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.0.0.beta1, \u003c 3.1.20\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.2.0, \u003c 3.2.5\"}]}], \"references\": [{\"url\": \"https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp\", \"name\": \"https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff\", \"name\": \"https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-18T18:59:31.964Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25500\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-18T19:42:35.101Z\", \"dateReserved\": \"2026-02-02T18:21:42.485Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-18T18:59:31.964Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

WID-SEC-W-2026-0881

Vulnerability from csaf_certbund - Published: 2026-03-25 23:00 - Updated: 2026-03-26 23:00

Summary

IBM License Metric Tool: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Das IBM License Metric Tool dient der Lizenzverwaltung für IBM Produkte.

Angriff: Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um Informationen offenzulegen, einen Cross Site Scripting Angriff durchzuführen oder einen Denial of Service zu verursachen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2025-68161

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
IBM License Metric Tool <9.2.43 IBM / License Metric Tool		<9.2.43

CVE-2026-22860

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
IBM License Metric Tool <9.2.43 IBM / License Metric Tool		<9.2.43

CVE-2026-25500

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
IBM License Metric Tool <9.2.43 IBM / License Metric Tool		<9.2.43

CVE-2026-25639

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
IBM License Metric Tool <9.2.43 IBM / License Metric Tool		<9.2.43

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.ibm.com/support/pages/node/7267652	external
https://security-tracker.debian.org/tracker/DSA-6180-1	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Das IBM License Metric Tool dient der Lizenzverwaltung f\u00fcr IBM Produkte.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um Informationen offenzulegen, einen Cross Site Scripting Angriff durchzuf\u00fchren oder einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0881 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0881.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0881 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0881"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-25",
        "url": "https://www.ibm.com/support/pages/node/7267652"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6180 vom 2026-03-27",
        "url": "https://security-tracker.debian.org/tracker/DSA-6180-1"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM License Metric Tool: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-26T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-27T09:01:48.461+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0881",
      "initial_release_date": "2026-03-25T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-25T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-03-26T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.2.43",
                "product": {
                  "name": "IBM License Metric Tool \u003c9.2.43",
                  "product_id": "T052193"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.43",
                "product": {
                  "name": "IBM License Metric Tool 9.2.43",
                  "product_id": "T052193-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:license_metric_tool:9.2.43"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "License Metric Tool"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-68161",
      "product_status": {
        "known_affected": [
          "2951",
          "T052193"
        ]
      },
      "release_date": "2026-03-25T23:00:00.000+00:00",
      "title": "CVE-2025-68161"
    },
    {
      "cve": "CVE-2026-22860",
      "product_status": {
        "known_affected": [
          "2951",
          "T052193"
        ]
      },
      "release_date": "2026-03-25T23:00:00.000+00:00",
      "title": "CVE-2026-22860"
    },
    {
      "cve": "CVE-2026-25500",
      "product_status": {
        "known_affected": [
          "2951",
          "T052193"
        ]
      },
      "release_date": "2026-03-25T23:00:00.000+00:00",
      "title": "CVE-2026-25500"
    },
    {
      "cve": "CVE-2026-25639",
      "product_status": {
        "known_affected": [
          "2951",
          "T052193"
        ]
      },
      "release_date": "2026-03-25T23:00:00.000+00:00",
      "title": "CVE-2026-25639"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-25500 (GCVE-0-2026-25500)

WID-SEC-W-2026-0881

Tags

Sightings

Nomenclature