Executive brief
Rack is a widely used interface for Ruby web applications that helps manage how web servers communicate with application code. A flaw in how it handles static files (like images or stylesheets) allows unauthorized users to access sensitive files that should be private. This could lead to the exposure of configuration files, database backups, or security credentials if they are stored in the same directory as public assets.
Technical details
The Rack::Static component performs static-route matching using a simple string prefix check (path.index(url) == 0) without enforcing path segment boundaries. When a URL prefix like '/css' is configured, the logic matches any request path starting with that string, such as '/css-config.env' or '/css-backup.sql', rather than just files within a '/css/' directory. An unauthenticated remote attacker can exploit this to download sensitive files located in the static root that happen to share a filename prefix with a permitted static directory. The issue is fixed in versions 2.2.23, 3.1.21, and 3.2.6 by ensuring matches occur only on exact prefix matches or at path boundaries.
Affected products
- Rack Rack < 2.2.23, >= 3.0.0.beta1 < 3.1.21, >= 3.2.0 < 3.2.6
- Red Hat Red Hat Satellite 6 6
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: NVD publication date
- 2026-04-02: patched: Patched versions released