CVE-2026-34763: 
Ruby vulnerability analysis and mitigation

CVE-2026-34763 is a root directory disclosure vulnerability in the Rack Ruby web server interface, caused by unescaped regex interpolation in Rack::Directory. When the configured root path contains regex metacharacters (e.g., +, *, .), the prefix-stripping logic fails and the full filesystem path is exposed in HTML directory listings. Affected versions include Rack prior to 2.2.23, 3.0.0.beta1 through 3.1.20, and 3.2.0 through 3.2.5. The vulnerability was published on April 2, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Rack Advisory).

The root cause is classified as CWE-625 (Permissive Regular Expression). In Rack::Directory::DirectoryBody#each, the visible path is computed using show_path = Utils.escape_html(path.sub(/\A#{root}/, '')), where root is a developer-configured filesystem path normalized via File.expand_path(root) but inserted directly into the regex without escaping via Regexp.escape. If root contains regex metacharacters, the substitution fails to strip the prefix, causing the absolute filesystem path to be rendered in the HTML directory listing instead of the relative path. Exploitation requires no authentication or user interaction — an attacker simply needs to browse a directory listing served by a vulnerable Rack::Directory instance whose root path contains metacharacters (Rack Advisory, GitHub Advisory).

Successful exploitation results in information disclosure of the server's absolute filesystem path, potentially revealing directory layout, usernames embedded in paths, mount points, or deployment naming conventions that would otherwise be hidden from clients. There is no impact on integrity or availability. While the direct impact is limited to confidentiality (low), the exposed path information can assist attackers in reconnaissance for further targeted attacks against the server (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043% (14th percentile), indicating a low probability of exploitation in the near term. Exploitation is constrained by the precondition that the Rack application must use Rack::Directory with a root path containing regex metacharacters, which limits the attack surface (GitHub Advisory).

1. Reconnaissance: Identify web applications built on Ruby/Rack that serve directory listings, using tools like Shodan, Censys, or manual browsing to find endpoints returning HTML directory indexes characteristic of Rack::Directory.
2. Identify vulnerable configuration: Determine whether the application's Rack::Directory root path contains regex metacharacters (e.g., paths with ., +, or * in directory names such as /var/www/app.v1+release/public).
3. Request a directory listing: Send a standard HTTP GET request to a path served by Rack::Directory (e.g., GET /files/ HTTP/1.1).
4. Observe disclosed path: Inspect the HTML response body for directory listing entries — if the root path contains metacharacters and the regex substitution fails, the full absolute filesystem path (e.g., /var/www/app.v1+release/public/subdir/file.txt) will appear in the listing instead of the relative path (/subdir/file.txt).
5. Leverage disclosed information: Use the exposed filesystem path to infer deployment structure, usernames, or mount points for further targeted attacks (Rack Advisory).

• Network: HTTP GET requests to directory-listing endpoints (e.g., paths served by Rack::Directory) from unfamiliar or scanning IP addresses, particularly with high frequency or systematic enumeration patterns.
• Logs: Web server access logs showing repeated requests to directory listing URLs; responses containing absolute filesystem paths in the HTML body (e.g., paths starting with /home/, /var/, /srv/, or /opt/) rather than relative paths.
• Application Behavior: HTML directory listing responses where file/directory links include the full server-side absolute path rather than a web-relative path, indicating the regex substitution has failed.

Upgrade Rack to a patched version: 2.2.23, 3.1.21, or 3.2.6 depending on your current version branch. As a temporary workaround, ensure that Rack::Directory root paths do not contain regex metacharacters (+, *, ., etc.), or disable Rack::Directory entirely if directory listing functionality is not required. IBM has also issued advisories for affected products including Aspera Faspex, Aspera Enterprise WebApps, Aspera Shares, CloudPak for AIOps, API Connect, and License Metric Tool v9, which should be updated per their respective bulletins (Rack Advisory, IBM Aspera Faspex, IBM CloudPak AIOps).

The vulnerability was reported by researcher harukioya, coordinated by ioquatix, and reviewed for remediation by jeremyevans within the Rack project. Ubuntu issued security notice USN-8182-1 and SUSE released updates (SUSE-SU-2026:1745-1 and SUSE-SU-2026:1964-1) addressing this issue. IBM issued multiple security bulletins covering affected products. No significant social media discussion or broader community controversy has been observed, consistent with the moderate severity rating (GitHub Advisory, Ubuntu Advisory, SUSE Advisory).