CVE-2025-61780: 
Ruby vulnerability analysis and mitigation

CVE-2025-61780 is a possible information disclosure vulnerability discovered in Rack::Sendfile when running behind a proxy that supports x-sendfile headers (such as Nginx). The vulnerability was disclosed on October 10, 2025, affecting Rack versions < 2.2.20, >= 3.0 < 3.1.18, and >= 3.2 < 3.2.3. Specially crafted headers could cause Rack::Sendfile to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions (GitHub Advisory).

The vulnerability occurs when Rack::Sendfile receives untrusted x-sendfile-type or x-accel-mapping headers from a client and interprets them as proxy configuration directives. This causes the middleware to send a 'redirect' response to the proxy, prompting it to reissue a new internal request that is not subject to the proxy's access controls. The vulnerability has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N (GitHub Advisory, Miggo).

Attackers could bypass proxy-enforced restrictions and access internal endpoints intended to be protected, such as administrative pages. While the vulnerability does not allow arbitrary file reads, it could expose sensitive application routes. The issue specifically affects systems where the application uses Rack::Sendfile with a proxy supporting x-accel-redirect, the proxy does not always set or remove the x-sendfile-type and x-accel-mapping headers, and the application exposes an endpoint that returns a body responding to .to_path (GitHub Advisory).

Users should upgrade to the fixed versions: Rack 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable x-accel-redirect. Alternatively, configure the proxy to always set or strip the headers using 'proxy_set_header x-sendfile-type x-accel-redirect' and 'proxy_set_header x-accel-mapping /var/www/=/files/'. For Rails applications, sendfile can be completely disabled by setting 'config.action_dispatch.x_sendfile_header = nil' (GitHub Advisory).