CVE-2026-126354

Received Received - Intake

Addressable Ruby URI Normalization Path Traversal

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126354

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Addressable gem in Ruby, specifically versions 2.2.5 to 2.9.1. It involves the Addressable::URI.normalize_path method incorrectly resolving paths with leading and later parent segments compared to RFC 3986 standards. This can cause the normalized path to differ from the original URI, potentially allowing unauthorized access if the application uses different paths for authorization and requests.

Detection Guidance

Detecting this vulnerability requires checking the version of the Addressable gem in your Ruby environment. Run 'gem list addressable' to see the installed version. If it is below 2.9.1, the system is vulnerable.

Impact Analysis

An attacker could exploit this to bypass path-based access controls, gaining unauthorized access to restricted resources. Applications relying on Addressable's normalization for authorization while sending the original URI for requests are at risk. The impact includes potential data breaches or privilege escalation if the application's path allowlist is bypassed.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection like GDPR (unauthorized access to personal data) or HIPAA (unauthorized access to protected health information). Organizations using affected versions may fail audits or face penalties due to insufficient access controls.

Mitigation Strategies

Upgrade the Addressable gem to version 2.9.1 or later using 'gem install addressable -v 2.9.1'. If using Bundler, update the Gemfile to specify 'gem addressable', '>= 2.9.1' and run 'bundle update addressable'.

Hi! I’m here to help you understand CVE-2026-126354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...