Log in Start free

Vulnerability · Published Feb 18, 2026 · Assigned by GitHub_M

CVE-2026-22860Rack has a Directory Traversal via Rack:Directory

High 7.5

In plain English

A high-severity path traversal in rack from rack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 44.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-rack2.2.22-0+deb12u1DSA-6180-1
Debian:12ruby-rack2.2.22-0+deb12u1DEBIAN-CVE-2026-22860
Debian:13ruby-rack3.1.20-0+deb13u1DEBIAN-CVE-2026-22860
Debian:13ruby-rack3.1.20-0+deb13u1DSA-6180-1
Debian:14ruby-rack3.2.5-1DEBIAN-CVE-2026-22860
RubyGemsrack3.2.5GHSA-mxw3-3hh2-x2mh
RubyGemsrack3.1.20GHSA-mxw3-3hh2-x2mh
RubyGemsrack2.2.22GHSA-mxw3-3hh2-x2mh
Ubuntu:24.04:LTSruby-rack2.2.7-1ubuntu0.6UBUNTU-CVE-2026-22860
Ubuntu:25.10ruby-rack3.1.16-0.1ubuntu0.2UBUNTU-CVE-2026-22860
Ubuntu:26.04:LTSruby-rack3.2.4-1ubuntu1UBUNTU-CVE-2026-22860
Ubuntu:26.10ruby-rack3.2.4-1ubuntu1UBUNTU-CVE-2026-22860

Affected products (as reported)

VendorProductVersions
rack rack < 2.2.22>= 3.0.0.beta1, < 3.1.20>= 3.2.0, < 3.2.5

Weakness: CWE-22, CWE-548 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References