sinatra does not validate expanded path matches

ALTO 7.5CVE-2022-29970 · GHSA-qp49-3pvw-x4m5 · Published 02/05/2022 · updated 17/06/2026

Em resumo

CVE-2022-29970 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta sinatra, sinatra (sinatrarb).
Chance de exploração nos próximos 30 dias (EPSS): 2.1%, maior que 82.0% das vulnerabilidades.
Correção: atualize para 2.2.0 ou posterior.

Package	Affected versions	Patched versions
sinatra RubyGems	`< 2.2.0`	`2.2.0`
sinatra sinatrarb	`< 2.2.0`	`2.2.0`

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

NVD description

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

RubyGems

< 2.2.0

2.2.0

< 2.2.0

2.2.0

Mais vulnerabilidades de sinatra

Ver tudo →