CVE-2026-22860

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22860
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22860.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22860
Aliases
Downstream
Related
Published
2026-02-18T18:45:02.095Z
Modified
2026-03-01T02:56:23.245160Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Rack has a Directory Traversal via Rack:Directory
Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../root_example/ can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-548"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22860.json"
}
References

Affected packages

Git / github.com/rack/rack

Affected ranges

Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0cc2e00b22dffc33955ef912569f01e515a406e1
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.22"
        }
    ]
}
Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
572a42a705b423ce98ef4e81435d4f60fb0ae53d
Fixed
65044344e4780d80b409f9ba27df41b6307b5ff5
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0.beta1"
        },
        {
            "fixed": "3.1.20"
        }
    ]
}
Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
b68251c03788ff39d4a4b25424df7360426e4afd
Fixed
bb5f3555bd12b9065112353e829298b3b5623ceb
Database specific 
{
    "versions": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.5"
        }
    ]
}

Affected versions

0.*
0.1
0.2
0.3
1.*
1.0
1.1
1.2
1.2.1
1.3.0
1.3.0.beta
1.3.0.beta2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.6.0.beta
1.6.0.beta2
2.*
2.0.0
2.0.0.alpha
2.0.0.rc1
2.0.1
2.1.0
2.2.0
2.2.3
2.2.3.1
2.2.4
3.*
3.0.0
3.0.0.beta1
3.0.0.rc1
v2.*
v2.2.1
v2.2.10
v2.2.11
v2.2.12
v2.2.13
v2.2.14
v2.2.15
v2.2.16
v2.2.17
v2.2.18
v2.2.19
v2.2.2
v2.2.20
v2.2.21
v2.2.5
v2.2.6
v2.2.6.1
v2.2.6.2
v2.2.6.3
v2.2.6.4
v2.2.7
v2.2.8
v2.2.8.1
v2.2.9
v3.*
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.4.1
v3.1.0
v3.1.10
v3.1.11
v3.1.12
v3.1.13
v3.1.14
v3.1.15
v3.1.16
v3.1.17
v3.1.18
v3.1.19
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22860.json"