CVE-2026-22860

Rack has a Directory Traversal via Rack:Directory

State: Published
Severity: 7.5 High
Published: Feb 18, 2026
Updated: Jul 15, 2026
Reserved: Jan 12, 2026

Description

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	redhat-SADP

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-548 Exposure of Information Through Directory Listing

Affected Products

Product	Versions
rackrack	< 2.2.22Affected >= 3.0.0.beta1, < 3.1.20Affected >= 3.2.0, < 3.2.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.