CVE-2026-34785
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.39%
- CWE
- CWE-187, CWE-200
- Published
- 2026-04-02
- Last modified
- 2026-07-15
Affected products
- rack rack
- rack rack
- rack rack
Weakness type
Related vulnerabilities
- CVE-2026-87853 — Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- CVE-2026-84376 — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CVE-2026-62750 — Windows HTTP Protocol Stack Tampering Vulnerability
- CVE-2026-14687 — 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
- CVE-2026-45692 — Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- CVE-2026-55602 — http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2026-44837 — view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- CVE-2026-35031 — Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain