CVE-2026-34763 Details
Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
A vulnerability in the Rack web server interface, specifically in the Rack::Directory component, allows for unintentional disclosure of the full filesystem path through improper handling of directory roots containing regular expression metacharacters. This issue is present in Rack versions prior to 2.2.23, 3.1.21, and 3.2.6. The vulnerability arises because the root path is directly interpolated into a regular expression without escaping, which can cause the prefix stripping mechanism to fail. As a result, the absolute filesystem path may be exposed in the HTML output of the directory listing, revealing sensitive internal details such as directory structures, usernames, and deployment conventions.
Users can update to Rack versions 2.2.23, 3.1.21, or 3.2.6, where this vulnerability has been patched. Alternatively, avoid using Rack::Directory with root paths that include regular expression metacharacters.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-625 | Permissive Regular Expression | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rack rack | < 2.2.23 >= 3.0.0, < 3.1.21 >= 3.2.0, < 3.2.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |