Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M

CVE-2026-34785Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching

High 7.5

In plain English

A high-severity information exposure in rack from rack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ruby-rack	2.2.22-0+deb12u2	DEBIAN-CVE-2026-34785
Debian:13	ruby-rack	3.1.20-0+deb13u2	DEBIAN-CVE-2026-34785
Debian:14	ruby-rack	3.2.6-2	DEBIAN-CVE-2026-34785
RubyGems	rack	2.2.23	GHSA-h2jq-g4cq-5ppq
RubyGems	rack	3.1.21	GHSA-h2jq-g4cq-5ppq
RubyGems	rack	3.2.6	GHSA-h2jq-g4cq-5ppq
Ubuntu:24.04:LTS	ruby-rack	2.2.7-1ubuntu0.7	UBUNTU-CVE-2026-34785
Ubuntu:25.10	ruby-rack	3.1.16-0.1ubuntu0.3	UBUNTU-CVE-2026-34785
Ubuntu:26.04:LTS	ruby-rack	3.2.4-1ubuntu1.1	UBUNTU-CVE-2026-34785
Ubuntu:26.04:LTS	ruby-rack	3.2.4-1ubuntu1.1	USN-8989-1

Affected products (as reported)

Vendor	Product	Versions
rack	rack	< 2.2.23>= 3.0.0.beta1, < 3.1.21>= 3.2.0, < 3.2.6

Weakness: CWE-187, CWE-200, CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-34785 vdb-entry, x_refsource_REDHAT
RHBZ#2454486 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34785.json x_sadp-csaf-vex