Executive brief
Rack is a widely used interface for Ruby web applications that helps manage how web servers communicate with application code. A security flaw in its file-handling component could allow an attacker to trick the web server into serving private or internal files that should not be accessible to the public. This occurs when a specific technical header is manipulated to bypass intended security boundaries, potentially leading to the exposure of sensitive system data.
Technical details
A regular expression injection vulnerability exists in Rack::Sendfile#map_accel_path. The component interpolates the value of the X-Accel-Mapping request header directly into a regular expression without proper escaping during path rewriting for X-Accel-Redirect. An attacker who can provide a crafted X-Accel-Mapping header to the backend can use regex metacharacters (e.g., '.*') to manipulate the resulting X-Accel-Redirect response header. This allows the attacker to bypass path restrictions and force the frontend proxy (like nginx) to serve unintended files from internal locations. The vulnerability is exploitable if the reverse proxy fails to strip or overwrite client-supplied X-Accel-Mapping headers. Patches are available in versions 2.2.23, 3.1.21, and 3.2.6.
Affected products
- Rack Rack < 2.2.23, >= 3.0.0.beta1 < 3.1.21, >= 3.2.0 < 3.2.6
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published by maintainers
- 2026-04-02: disclosed: CVE published to NVD