CVE-2026-22860: 
Ruby vulnerability analysis and mitigation

CVE-2026-22860 is a directory traversal vulnerability in the Rack::Directory middleware of the Rack Ruby web server interface. The flaw allows unauthenticated remote attackers to list directories outside the configured root by exploiting a flawed string prefix match in path validation. Affected versions include all Rack releases prior to 2.2.22, versions 3.0.0 through 3.1.19, and versions 3.2.0 through 3.2.4. It was published on February 16, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Rack Security Advisory).

The root cause lies in lib/rack/directory.rb, where the path validation check File.expand_path(File.join(root, path_info)).start_with?(root) uses a simple string prefix match without enforcing a path separator boundary (CWE-22, CWE-548). This means that if the configured root is /var/www/root, a resolved path like /var/www/root_backup passes the check because it shares the same string prefix. An attacker can craft a request such as GET /../root_example/ to traverse outside the intended root and trigger a directory listing of sibling directories that share the root's name prefix. The fix, introduced in commit 75c5745, adds a @root_with_separator variable and changes the check to expanded_path == @root || expanded_path.start_with?(@root_with_separator), enforcing a proper boundary (Rack Commit, GitHub Advisory).

Successful exploitation results in unauthorized directory listing outside the configured root, exposing sensitive file names and directory structures to unauthenticated remote attackers. This is a confidentiality-only impact — integrity and availability are not affected — but the disclosed directory contents (e.g., backup directories, configuration folders) could facilitate further attacks such as targeted file access or credential harvesting. The vulnerability is exploitable only when Rack::Directory is exposed to untrusted clients and a sibling directory shares the root's name prefix (GitHub Advisory, Rack Security Advisory).

A proof-of-concept exploit reference is available via the GitHub Security Advisory, though no evidence of active in-the-wild exploitation has been reported (Feedly). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit if the preconditions are met. The EPSS score is approximately 0.043% (0.123% per GitHub Advisory), placing it in the 31st percentile for exploitation likelihood. No threat actor attribution or CISA KEV catalog listing has been identified at this time.

1. Reconnaissance: Identify web applications using Rack versions prior to 2.2.22, 3.1.20, or 3.2.5 that expose Rack::Directory to serve static files. Tools like Shodan, Censys, or HTTP response headers (e.g., X-Powered-By: Rack) can assist in fingerprinting.
2. Identify root directory name: Determine or guess the configured root directory name (e.g., /var/www/root or /app/public) through error messages, documentation, or prior reconnaissance.
3. Identify sibling directory: Determine or guess the name of a sibling directory that shares the root's string prefix (e.g., root_backup, public2, www_backup).
4. Craft traversal request: Send an HTTP GET request using a path traversal sequence that resolves to the sibling directory, such as GET /../root_backup/ HTTP/1.1. The .. segment causes File.expand_path to resolve outside the root, and the resulting path passes the flawed prefix check.
5. Obtain directory listing: If the preconditions are met, Rack::Directory returns an HTML directory listing of the sibling directory, revealing file names and subdirectory structures outside the intended root (GitHub Advisory, Rack Commit).

• Network: HTTP GET requests containing .. path traversal sequences targeting paths adjacent to the configured root (e.g., GET /../root_backup/ or GET /../public2/); requests returning HTTP 200 with directory listing content from unexpected paths.
• Logs: Web server or Rack access logs showing requests with /../ patterns resolving to directories outside the configured root; repeated enumeration attempts against multiple sibling directory name variations.
• File System: No file system changes are expected, as this is a read-only directory listing vulnerability; however, presence of sensitive sibling directories (e.g., *_backup, *2) adjacent to the Rack root should be audited.

Upgrade Rack to the appropriate patched version based on your current release line: 2.2.22, 3.1.20, or 3.2.5 (GitHub Advisory). As a temporary workaround, avoid naming directories with the same string prefix as the directory exposed via Rack::Directory (e.g., rename public_backup to backup_public). IBM API Connect and IBM Guardium Data Security Center users should apply the vendor-specific patches referenced in IBM's advisories (IBM API Connect, IBM Guardium). Review application logs for suspicious traversal attempts while patches are being deployed.

The vulnerability was reported by security researcher Masamuneee, with remediation review by jeremyevans and coordination by ioquatix (Rack maintainer), reflecting a responsible disclosure process (GitHub Advisory). Red Hat tracked the issue via Bugzilla with high severity, and downstream distributions including Ubuntu, Debian, and openSUSE issued security advisories and package updates (Red Hat Bugzilla, Ubuntu Advisory). Tenable and Qualys added detection plugins for the vulnerability, and it was covered by standard vulnerability aggregators without notable controversy or widespread community debate.