Skip to content
OpenAdvisories
High DLA-4505-1 2 CVEs

ruby-rack - security update

Published Mar 23, 2026 · Updated Mar 23, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 ruby-rack 2.1.4-3+deb11u5

Vulnerabilities 2

  • High 7.5
    CVE-2026-22860

    Rack has a Directory Traversal via Rack:Directory

    Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path star…

    rack rack kube-fluentd-operator logstash-9.3 Debian Ubuntu Wolfi RubyGems
  • Medium 5.4
    CVE-2026-25500

    Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

    Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javas…

    rack rack kube-fluentd-operator logstash-9.3 Debian Ubuntu Wolfi RubyGems