Rack hat eine Offenlegung des Root-Verzeichnisses durch nicht maskierte Regex-Interpolation in Rack::Directory

The core of the vulnerability lies in how Rack::Directory constructs the path displayed in directory listings. The root configuration parameter, intended to define the base directory for the listing, is directly interpolated into a regular expression. If this root parameter contains characters like +, *, or ., which have special meaning in regular expressions, the path stripping logic can fail. This failure can result in the HTML output revealing the complete filesystem path, rather than just the intended subdirectory. An attacker could craft a malicious root value to bypass the intended security boundaries and access files outside the intended scope. This could lead to exposure of configuration files, source code, or other sensitive data. The blast radius is limited to the web application using Rack, but the potential impact of data exposure can be significant.

Applications using Rack versions 2.2.9 and earlier are at risk, particularly those that expose directory listing functionality or allow user-controlled configuration of the root parameter. Shared hosting environments where Rack is used and the root path is not carefully managed are also at increased risk.

• ruby / server:

find / -name 'rack-2.2.9*' -type d -print

• ruby / server:

grep -r 'Utils.escape_html(path.sub(/\A#{root}/, '')' /usr/local/lib/ruby*/gems*/rack-*/lib/rack/directory.rb

• generic web: Inspect directory listing endpoints for unusual file paths or unexpected content. Examine access logs for requests containing regex metacharacters in the directory path.

1. 2026-04-02Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-02
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-10

The primary mitigation for CVE-2026-34763 is to upgrade to Rack version 2.2.23 or later, which includes the necessary sanitization improvements. If upgrading is not immediately feasible, consider implementing a WAF rule to filter requests containing potentially malicious characters in the root parameter. Alternatively, carefully validate and sanitize the root configuration parameter within your Rack application to prevent the inclusion of regex metacharacters. Review your Rack application's configuration to ensure that the root parameter is not derived from user input or any untrusted source. After upgrading, confirm the fix by attempting to access a directory listing with a crafted root parameter containing regex metacharacters; the listing should not reveal the full filesystem path.