Description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 1.4.1-2.1 | — |
| Debian 13 | ruby-rack | 1.4.1-2.1 | — |
| Debian 12 | ruby-rack | 1.4.1-2.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ruby-rack | 1.5.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | jenkins | 1.502-1.el6op | RHSA-2013:0638 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-jenkins-1.4 | 1.0.3-1.el6op | RHSA-2013:0638 |
| Red Hat OpenShift 1 | ruby193-rubygem-rack | 1:1.4.1-4.el6 | RHSA-2013:0638 |
| Red Hat OpenShift 1 | rubygem-rack | 1:1.3.0-4.el6op | RHSA-2013:0638 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-rack | 3.0.7-1.2 | openSUSE-SU-2024:13167-1 |
| openSUSE Tumbleweed | ruby3.2-rubygem-rack-2.2 | 2.2.7-1.1 | openSUSE-SU-2024:12974-1 |
| openSUSE Tumbleweed | rubyem-rack | 1.4.7-1.8 | openSUSE-SU-2024:10115-1 |
| openSUSE Tumbleweed | rubygem-rack | 2.2.3.1-1.1 | openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1, openSUSE-SU-2024:13726-1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.4-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14811-1, openSUSE-SU-2024:13727-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | >= 1.5.0, < 1.5.2 | 1.5.2 | GHSA-85r7-w5mv-c849 |
| RubyGems | rack | >= 1.4.0, < 1.4.5 | 1.4.5 | GHSA-85r7-w5mv-c849 |
Advisories 12
- RHSA-2013:0638 Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.2 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10358-1 ruby4.0-rubygem-rack-3.1.18-1.3 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- openSUSE-SU-2025:14811-1 ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10115-1 ruby2.2-rubygem-rack-1_4-1.4.7-1.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13727-1 ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13167-1 ruby3.2-rubygem-rack-3.0.7-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12119-1 ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13726-1 ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12397-1 ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12974-1 ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14875-1 ruby3.4-rubygem-rack-3.1.12-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ
- https://gist.github.com/rentzsch/4736940
- 52033 third-party-advisory
- http://rack.github.com/
- https://bugzilla.redhat.com/show_bug.cgi?id=909071
- https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
- https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30
- openSUSE-SU-2013:0462 vendor-advisory
- https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56
- https://bugzilla.redhat.com/show_bug.cgi?id=909072