Is CVE-2026-125110 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125110 being exploited in the wild.

How severe is CVE-2026-125110?

Medium severity, with a CVSS score of 5.3, published 9 November 2026.

Which products and versions are affected?

rack (RubyGems) < 2.2.25, ECOSYSTEM:introduced=0,fixed=2.2.25.

How is CVE-2026-125110 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125110?

Check whether you run Ruby Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125110: Rack::Static header_rules bypass via dot-segment normalization mismatch

Q: Which products and versions are affected?

rack (RubyGems) < 2.2.25, ECOSYSTEM:introduced=0,fixed=2.2.25.

Q: Is there a fix for CVE-2026-125110?

Yes. rack (RubyGems): upgrade to 2.2.25 or later. Until then: Reject requests containing dot segments at a reverse proxy or application boundary. Do not rely solely on Rack::Static header_rules to prevent inline rendering of untrusted uploads; serve them from a separate origin. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-125110 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-125110?

Check whether you run Ruby Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125110 · Severity: medium · CVSS 5.3 · Published 2026-11-09

Rack::Static is a Ruby library component that serves static files and applies security headers. An attacker can request protected static files using dot-segment path traversal tricks (like /assets/../uploads/file.html) to bypass the security headers intended for those files, potentially exposing content like HTML uploads that could be rendered inline or downloadable without proper Content-Disposition headers.

Technologies: rack (RubyGems). Vendors: Ruby, RubyGems.

Quick answers

Is CVE-2026-125110 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125110 being exploited in the wild.
How severe is CVE-2026-125110?: Medium severity, with a CVSS score of 5.3, published 9 November 2026.
Which products and versions are affected?: rack (RubyGems) < 2.2.25, ECOSYSTEM:introduced=0,fixed=2.2.25.
Is there a fix for CVE-2026-125110?: Yes. rack (RubyGems): upgrade to 2.2.25 or later. Until then: Reject requests containing dot segments at a reverse proxy or application boundary. Do not rely solely on Rack::Static header_rules to prevent inline rendering of untrusted uploads; serve them from a separate origin. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125110 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125110?: Check whether you run Ruby Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rack (RubyGems): upgrade to 2.2.25 or later
```
bundle update rack
```

Reject requests containing dot segments at a reverse proxy or application boundary. Do not rely solely on Rack::Static header_rules to prevent inline rendering of untrusted uploads; serve them from a separate origin.

Technical details

Rack::Static normalizes request paths using Utils.clean_path_info when deciding which file to serve, but matches header_rules only against URL-decoded paths without dot-segment normalization. An attacker can request /assets/../uploads/file.html or /assets/..%2fuploads/file.html to receive the normalized file (uploads/file.html) while bypassing header_rules checks that expect the clean path. This is a path normalization mismatch; the fix for CVE-2026-34786 added URL decoding to rule matching but omitted normalization.

Affected products

Ruby Rack

Identifiers

CVE-2026-125110
GHSA-wvg4-6p58-3gh3

Timeline

2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.