Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-34830Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
Medium 5.9
In plain English
A medium-severity security flaw in rack from rack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-rack | 2.2.22-0+deb12u2 | DEBIAN-CVE-2026-34830 |
| Debian:13 | ruby-rack | 3.1.20-0+deb13u2 | DEBIAN-CVE-2026-34830 |
| Debian:14 | ruby-rack | 3.2.6-2 | DEBIAN-CVE-2026-34830 |
| RubyGems | rack | 2.2.23 | GHSA-qv7j-4883-hwh7 |
| RubyGems | rack | 3.1.21 | GHSA-qv7j-4883-hwh7 |
| RubyGems | rack | 3.2.6 | GHSA-qv7j-4883-hwh7 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.7 | UBUNTU-CVE-2026-34830 |
| Ubuntu:25.10 | ruby-rack | 3.1.16-0.1ubuntu0.3 | UBUNTU-CVE-2026-34830 |
| Ubuntu:26.04:LTS | ruby-rack | 3.2.4-1ubuntu1.1 | UBUNTU-CVE-2026-34830 |
| Ubuntu:26.04:LTS | ruby-rack | 3.2.4-1ubuntu1.1 | USN-8989-1 |
Affected products (as reported)
Weakness: CWE-625 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7 x_refsource_CONFIRM