Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
References
| Link | Resource |
|---|---|
| https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7 | Patch |
| https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
19 Feb 2026, 18:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7 - Patch | |
| References | () https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh - Exploit, Mitigation, Vendor Advisory | |
| First Time |
Rack rack
Rack |
|
| CPE | cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* |
18 Feb 2026, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-18 19:21
Updated : 2026-02-19 18:27
NVD link : CVE-2026-22860
Mitre link : CVE-2026-22860
CVE.ORG link : CVE-2026-22860
JSON object : View
Products Affected
rack
- rack