CVE-2026-34763

EUVD-2026-18380

02.04.2026, 17:16

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 15.41%

Affected Products (NVD)

Vendor	Product	Version
rack	rack	𝑥 < 2.2.23
rack	rack	3.0.0 ≤ 𝑥 < 3.1.21
rack	rack	3.2.0 ≤ 𝑥 < 3.2.6

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ruby-rack

bookworm	vulnerable
bookworm (security)	2.2.22-0+deb12u2 fixed
bullseye	vulnerable
bullseye (security)	2.1.4-3+deb11u6 fixed
forky	3.2.6-3 fixed
sid	3.2.6-3 fixed
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ruby-rack

bionic	Fixed 1.6.4-4ubuntu0.2+esm10 released
focal	Fixed 2.0.7-2ubuntu0.1+esm10 released
jammy	Fixed 2.1.4-5ubuntu1.2+esm3 released
noble	Fixed 2.2.7-1ubuntu0.7 released
questing	Fixed 3.1.16-0.1ubuntu0.3 released
resolute	needed
trusty	Fixed 1.5.2-3+deb8u3ubuntu1~esm11 released
xenial	Fixed 1.6.4-3ubuntu0.2+esm10 released

openSUSE / SLES Releases

openSUSE Product

Release

rmt-server

suse enterprise sap 15 SP5	2.27-150500.3.47.1 fixed
suse enterprise sap 15 SP6	2.27-150500.3.47.1 fixed
suse enterprise sap 15 SP7	2.27-150700.3.20.1 fixed
suse enterprise server 15 SP4	2.27-150400.3.54.1 fixed
suse enterprise server 15 SP5	2.27-150500.3.47.1 fixed
suse enterprise server 15 SP6	2.27-150500.3.47.1 fixed
suse enterprise server 15 SP7	2.27-150700.3.20.1 fixed

rmt-server-config

suse enterprise sap 15 SP5	2.27-150500.3.47.1 fixed
suse enterprise sap 15 SP6	2.27-150500.3.47.1 fixed
suse enterprise sap 15 SP7	2.27-150700.3.20.1 fixed
suse enterprise server 15 SP4	2.27-150400.3.54.1 fixed
suse enterprise server 15 SP5	2.27-150500.3.47.1 fixed
suse enterprise server 15 SP6	2.27-150500.3.47.1 fixed
suse enterprise server 15 SP7	2.27-150700.3.20.1 fixed

rmt-server-pubcloud

suse enterprise server 15 SP4

2.27-150400.3.54.1

fixed

Common Weakness Enumeration

CWE-625 - Permissive Regular Expression
The product uses a regular expression that does not sufficiently restrict the set of allowed values.

References

https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp