CVE-2026-22860

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22860
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22860.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22860
Aliases
Downstream
Related
Published
2026-02-18T18:45:02.095Z
Modified
2026-07-08T07:25:18.800736007Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Rack has a Directory Traversal via Rack:Directory
Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../root_example/ can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22860.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-548"
    ]
}
References

Affected packages

Git / github.com/rack/rack

Affected ranges

Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0cc2e00b22dffc33955ef912569f01e515a406e1
Introduced
52901caf09ebcda879512a8605059963a49df55d
Fixed
65044344e4780d80b409f9ba27df41b6307b5ff5
Introduced
b68251c03788ff39d4a4b25424df7360426e4afd
Fixed
bb5f3555bd12b9065112353e829298b3b5623ceb
Fixed
75c5745c286637a8f049a33790c71237762069e7
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.22"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.20"
        },
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.5"
        }
    ]
}

Affected versions

0.*
0.1
0.2
0.3
1.*
1.0
1.3.0
1.3.0.beta
1.3.0.beta2
1.4.0
1.4.1
1.5.0
1.5.1
1.6.0.beta
2.*
2.0.0
2.0.0.alpha
2.0.0.rc1
2.0.1
2.1.0
2.2.0
2.2.3
2.2.4
3.*
3.0.0
v2.*
v2.2.1
v2.2.10
v2.2.11
v2.2.12
v2.2.13
v2.2.14
v2.2.15
v2.2.16
v2.2.17
v2.2.18
v2.2.19
v2.2.2
v2.2.20
v2.2.21
v2.2.5
v2.2.6
v2.2.6.1
v2.2.6.2
v2.2.7
v2.2.8
v2.2.9
v3.*
v3.1.0
v3.1.10
v3.1.11
v3.1.12
v3.1.13
v3.1.14
v3.1.15
v3.1.16
v3.1.17
v3.1.18
v3.1.19
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22860.json"