CVE catalog

CVE-2026-22860

Rack vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.76% · Oct 25, 2026

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1fixed
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1fixed
Debianruby-rackbookworm-security2.2.22-0+deb12u2fixed
Ubunturuby-racknobleNot reportedvulnerable
Ubunturuby-racknoble2.2.7-1ubuntu0.6fixed
Ubunturuby-rackpro2.1.4-3vulnerable
Ubunturuby-rackpro2.1.4-4vulnerable
Ubunturuby-rackpro2.1.4-5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm3vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm4vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm2fixed
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.2vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.3vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.4vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.5vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.6fixed
Ubunturuby-rack25.102.2.7-1.1vulnerable
Ubunturuby-rack25.103.1.16-0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid3.2.5-1not yet assignedNot reported[1128479]
Debianruby-racksourceforky3.2.5-1not yet assignedNot reported[1128479]
Debianruby-racksourcetrixie3.1.20-0+deb13u1not yet assignedNot reported[1128479]
Debianruby-racksourcebookworm2.2.22-0+deb12u1not yet assignedNot reported[1128479]
Ubunturuby-rackdebnoble2.2.7-1ubuntu0.6Not reportedNot reportedNot reported
Ubunturuby-rackdebpro2.1.4-5ubuntu1.2+esm2Not reportedUSN-8066-1Not reported
Ubunturuby-rackdeb24.042.2.7-1ubuntu0.6Not reportedUSN-8066-1Not reported
Ubunturuby-rackdeb25.103.1.16-0.1ubuntu0.2Not reportedUSN-8066-1Not reported

[Debian bug #1128479]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-rack]Fixed
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.22-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.22-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.22-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.22-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

[Debian 13 (Trixie)]

  • [ruby-rack]Fixed
    Details (5)

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.1.20-0+deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.1.20-0+deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.1.20-0+deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.1.20-0+deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u2 · all · trixie-security

      Fixed · Fixed: 3.1.20-0+deb13u1

      usn · ruby-rack · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]