Rack hat eine Directory Traversal via Rack:Directory

The core of the vulnerability lies in Rack::Directory’s flawed path check, which uses a simple string prefix match. An attacker can craft a malicious request, such as /../rootexample/, that exploits this weakness. If the target path shares a prefix with the configured root directory (e.g., /var/www/root and /var/www/rootbackup), the check will pass, granting the attacker access to the unintended directory. This can lead to the exposure of sensitive configuration files, source code, or other critical data stored outside the intended web root. The potential blast radius depends on the permissions granted to the web server user and the sensitivity of the data accessible within the affected directories.

Applications built using the Ruby Rack framework, particularly those that expose directory listing functionality or handle user-supplied paths without proper validation, are at risk. Shared hosting environments where multiple applications share the same Rack installation are also particularly vulnerable, as a compromise of one application could potentially expose the entire environment.

• ruby / gem: Use gem list to identify Rack versions. Look for versions less than or equal to 2.2.9.

gem list rack

• linux / server: Examine web server access logs for requests containing suspicious path traversal sequences (e.g., ../).

grep '../' /var/log/apache2/access.log

• generic web: Test Rack-based applications with path traversal payloads (e.g., /../etc/passwd) to identify potential vulnerabilities. Use curl to send requests and inspect the response.

curl http://your-rack-app/../etc/passwd

1. 2026-02-17Disclosure

   disclosure

1. Reserviert2026-01-12
2. Veröffentlicht2026-02-17
3. Geändert2026-02-24
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22860 is to upgrade to Rack version 2.2.22 or later, which includes the corrected path boundary check. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal sequences like ../. Additionally, review and restrict file system permissions for the web server user to minimize the potential impact of a successful attack. Regularly scan your Ruby environment for outdated Rack versions using tools like gem list to proactively identify vulnerable installations.