CVE-2026-22860: Directory Traversal in Ruby Rack

The core of the vulnerability lies in Rack::Directory’s flawed path check, which uses a simple string prefix match. An attacker can craft a malicious request, such as /../rootexample/, that exploits this weakness. If the target path shares a prefix with the configured root directory (e.g., /var/www/root and /var/www/rootbackup), the check will pass, granting the attacker access to the unintended directory. This can lead to the exposure of sensitive configuration files, source code, or other critical data stored outside the intended web root. The potential blast radius depends on the permissions granted to the web server user and the sensitivity of the data accessible within the affected directories.

1. Reserved2026-01-12
2. Published2026-02-17
3. Modified2026-02-24
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-22860 is to upgrade to Rack version 2.2.22 or later, which includes the corrected path boundary check. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal sequences like ../. Additionally, review and restrict file system permissions for the web server user to minimize the potential impact of a successful attack. Regularly scan your Ruby environment for outdated Rack versions using tools like gem list to proactively identify vulnerable installations.