CVE-2026-22860 - Vulnerability Details - OpenCVE

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7
https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh

History

Wed, 18 Feb 2026 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 18 Feb 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Title		Rack has a Directory Traversal via Rack:Directory
Weaknesses		CWE-22 CWE-548
References		https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7 https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-02-18T18:45:02.095Z

Updated: 2026-02-18T19:28:38.445Z

Reserved: 2026-01-12T16:20:16.746Z

Link: CVE-2026-22860

Vulnrichment

Updated: 2026-02-18T19:28:26.018Z

NVD

Status : Received

Published: 2026-02-18T19:21:43.933

Modified: 2026-02-18T19:21:43.933

Link: CVE-2026-22860

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22860", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-12T16:20:16.746Z", "datePublished": "2026-02-18T18:45:02.095Z", "dateUpdated": "2026-02-18T19:28:38.445Z"}, "containers": {"cna": {"title": "Rack has a Directory Traversal via Rack:Directory", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-548", "lang": "en", "description": "CWE-548: Exposure of Information Through Directory Listing", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh"}, {"name": "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7"}], "affected": [{"vendor": "rack", "product": "rack", "versions": [{"version": "< 2.2.22", "status": "affected"}, {"version": ">= 3.0.0.beta1, < 3.1.20", "status": "affected"}, {"version": ">= 3.2.0, < 3.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T18:45:02.095Z"}, "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`\u2019s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue."}], "source": {"advisory": "GHSA-mxw3-3hh2-x2mh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T19:27:31.243687Z", "id": "CVE-2026-22860", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T19:28:38.445Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T19:27:31.243687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T19:28:26.018Z"}}], "cna": {"title": "Rack has a Directory Traversal via Rack:Directory", "source": {"advisory": "GHSA-mxw3-3hh2-x2mh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rack", "product": "rack", "versions": [{"status": "affected", "version": "< 2.2.22"}, {"status": "affected", "version": ">= 3.0.0.beta1, < 3.1.20"}, {"status": "affected", "version": ">= 3.2.0, < 3.2.5"}]}], "references": [{"url": "https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh", "name": "https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7", "name": "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`\u2019s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-548", "description": "CWE-548: Exposure of Information Through Directory Listing"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T18:45:02.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22860", "state": "PUBLISHED", "dateUpdated": "2026-02-18T19:28:38.445Z", "dateReserved": "2026-01-12T16:20:16.746Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-18T18:45:02.095Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}