CVE-2026-34785
Path Traversal in Rack::Static Causes Information Disclosure
Publication date: 2026-04-02
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rack | rack | From 3.0.0 (inc) to 3.1.21 (exc) |
| rack | rack | From 3.2.0 (inc) to 3.2.6 (exc) |
| rack | rack | to 2.2.23 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-187 | The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Ruby Rack library's Rack::Static middleware, which serves static files based on URL prefix matching.
Rack::Static uses a simple string prefix check to decide if a request path should be served as a static file. It checks if the request path starts with a configured prefix string (like "/css"), but it does not ensure that the prefix is followed by a path separator such as "/".
Because of this, requests for paths like "/css-config.env" or "/css-backup.sql" are matched and served if such files exist under the static root directory, even though these files are not intended to be exposed.
This leads to unintentional exposure of files whose names merely start with the configured prefix, causing information disclosure.
The issue has been fixed in patched versions of Rack that enforce stricter matching rules requiring the matched path to be exactly equal to the prefix or start with the prefix followed by a "/" character.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to access sensitive files located under the static root directory that share the configured URL prefix.
This may include configuration files, secrets, backup files, environment files, or other unintended static content.
Such unauthorized access leads to information disclosure, potentially exposing confidential data without requiring any privileges or user interaction.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your Ruby Rack application is using an affected version of the Rack library (versions less than 2.2.23, versions >= 3.0 and < 3.1.21, or versions >= 3.2 and < 3.2.6) that uses the vulnerable Rack::Static middleware.
You can also test if your server unintentionally serves files whose names start with configured static URL prefixes but are not intended to be exposed. For example, if your static URL prefix is "/css", try requesting paths like "/css-config.env" or "/css-backup.sql" to see if these files are served.
Suggested commands to detect this behavior include using curl or wget to request such paths from your server:
- curl -I http://yourserver/css-config.env
- curl -I http://yourserver/css-backup.sql
- curl -I http://yourserver/csssecrets.yml
If these requests return HTTP 200 responses with file contents, it indicates the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating your Rack library to a patched version where this vulnerability is fixed. The patched versions are 2.2.23, 3.1.21, and 3.2.6.
Additionally, avoid placing sensitive files under the static root directory to prevent accidental exposure.
You should also review and adjust your static URL mappings to ensure they do not overlap with sensitive filenames.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can lead to unintended information disclosure by allowing access to sensitive files such as configuration files, secrets, backups, and environment files located under the static root directory. Such exposure of sensitive information may result in non-compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.
Organizations using affected versions of Rack should update to patched versions and avoid placing sensitive files under the static root directory to mitigate the risk and maintain compliance with these standards.