Skip to content
Heist/ feed
Back to feed
High

Rack has a Directory Traversal via Rack:Directory

Type: advisorySources: OSV

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-22860
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 15:29 UTC · Revision 1

Source evidence

Rack has a Directory Traversal via Rack:Directory

core-osv · Original source

Published 18 Feb 2026, 18:45 UTC

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

osv:CVE-2026-22860
Complete source record
{
  "id": "e67db41880ca5f8502439645808a65252c7a5bbd8c987502662029ecafd8fdcc",
  "url": "https://osv.dev/vulnerability/CVE-2026-22860",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Rack has a Directory Traversal via Rack:Directory",
    "summary": "Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.",
    "evidence": "osv:CVE-2026-22860",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-22860",
      "aliases": [
        "CVE-2026-22860",
        "GHSA-mxw3-3hh2-x2mh"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/rack/rack",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0cc2e00b22dffc33955ef912569f01e515a406e1"
                },
                {
                  "introduced": "52901caf09ebcda879512a8605059963a49df55d"
                },
                {
                  "fixed": "65044344e4780d80b409f9ba27df41b6307b5ff5"
                },
                {
                  "introduced": "b68251c03788ff39d4a4b25424df7360426e4afd"
                },
                {
                  "fixed": "bb5f3555bd12b9065112353e829298b3b5623ceb"
                },
                {
                  "fixed": "75c5745c286637a8f049a33790c71237762069e7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.2.22"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
                    "range": [
                      {
                        "introduced": "3.0.0"
                      },
                      {
                        "fixed": "3.1.20"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
                    "range": [
                      {
                        "introduced": "3.2.0"
                      },
                      {
                        "fixed": "3.2.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "75c5745c286637a8f049a33790c71237762069e7"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.1.19",
            "v3.2.4",
            "v2.2.21",
            "v3.2.3",
            "v3.1.18",
            "v2.2.20",
            "v2.2.19",
            "v3.1.17",
            "v3.2.2",
            "v3.2.1",
            "v2.2.18",
            "v2.2.17",
            "v3.2.0",
            "v3.1.16",
            "v2.2.16",
            "v3.1.15",
            "v2.2.15",
            "v2.2.14",
            "v3.1.14",
            "v3.1.13",
            "v2.2.13",
            "v3.1.12",
            "v3.1.11",
            "v2.2.12",
            "v3.1.10",
            "v2.2.11",
            "v2.2.10",
            "v3.1.9",
            "v3.1.8",
            "v3.1.7",
            "v2.2.9",
            "v3.1.6",
            "v3.1.5",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.1.0",
            "v2.2.8",
            "v2.2.7",
            "v2.2.6.2",
            "v2.2.6.1",
            "v2.2.6",
            "v2.2.5",
            "2.2.4",
            "3.0.0",
            "2.2.3",
            "v2.2.2",
            "v2.2.1",
            "2.2.0",
            "2.1.0",
            "2.0.1",
            "2.0.0",
            "2.0.0.rc1",
            "2.0.0.alpha",
            "1.6.0.beta",
            "1.5.1",
            "1.5.0",
            "1.4.1",
            "1.4.0",
            "1.3.0",
            "1.3.0.beta2",
            "1.3.0.beta",
            "1.0",
            "0.3",
            "0.2",
            "0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22860.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:20.663593290Z",
      "provider": "osv",
      "references": [
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22860.json",
        "https://access.redhat.com/security/cve/CVE-2026-22860",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22860.json",
        "https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-22860",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2440737",
        "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22",
          "CWE-548"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22860.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-22860",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 486532,
  "published_at": "2026-02-18T18:45:02.095+00:00"
}