| Package | Affected versions | Patched versions |
|---|---|---|
| rack | ≥ 3.0.0.beta1, < 3.1.20≥ 3.2.0, < 3.2.5< 2.2.22 | 3.1.203.2.52.2.22 |
| rack | ≥ 3.0.0, < 3.1.20≥ 3.2.0, < 3.2.5< 2.2.22 | 3.1.203.2.52.2.22 |
Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../root_example/ can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root.
In directory.rb, File.expand_path(File.join(root, path_info)).start_with?(root) does not enforce a path boundary. If the server root is /var/www/root, a path like /var/www/root_backup passes the check because it shares the same prefix, so Rack::Directory will list that directory also.
Information disclosure via directory listing outside the configured root when Rack::Directory is exposed to untrusted clients and a directory shares the root prefix (e.g., public2, www_backup).
Rack::Directory.Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free