CVE-2025-27610
published 2025-03-10CVE-2025-27610: Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.07%
60.6th percentile
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-rack | < ruby-rack 2.2.13-1~deb12u1 (bookworm) | ruby-rack 2.2.13-1~deb12u1 (bookworm) |
| rack | rack | < 2.2.13 | 2.2.13 |
| rack | rack | — | — |
| rack | rack | — | — |
| rack | rack | >= 0 < 2.2.13 | 2.2.13 |
| rack | rack | >= 3.0 < 3.0.14 | 3.0.14 |
| rack | rack | >= 3.0.0 < 3.0.14 | 3.0.14 |
| rack | rack | >= 3.1 < 3.1.12 | 3.1.12 |
| rack | rack | >= 3.1.0 < 3.1.12 | 3.1.12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ruby-rack vulnerabilities
osv·2025-07-23·CVSS 5.7
CVE-2025-25184 [MEDIUM] ruby-rack vulnerabilities
ruby-rack vulnerabilities
USN-7366-1 fixed vulnerabilities in Rack. This update provides the
corresponding updates for Ubuntu 25.04.
Original advisory details:
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
OSV
ruby-rack vulnerabilities
osv·2025-03-24·CVSS 5.7
CVE-2025-25184 [MEDIUM] ruby-rack vulnerabilities
ruby-rack vulnerabilities
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
OSV
CVE-2025-27610: Rack provides an interface for developing web applications in Ruby
osv·2025-03-10·CVSS 7.5
CVE-2025-27610 [HIGH] CVE-2025-27610: Rack provides an interface for developing web applications in Ruby
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitiga
OSV
Local File Inclusion in Rack::Static
osv·2025-03-10
CVE-2025-27610 [HIGH] Local File Inclusion in Rack::Static
Local File Inclusion in Rack::Static
## Summary
`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.
## Details
The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.
## Impact
By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.
## Mitigation
- Update to the latest version of Rack, or
- Remove usage of `Rack::Static`, or
- Ensure that `root:`
GHSA
Local File Inclusion in Rack::Static
ghsa·2025-03-10
CVE-2025-27610 [HIGH] CWE-23 Local File Inclusion in Rack::Static
Local File Inclusion in Rack::Static
## Summary
`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.
## Details
The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.
## Impact
By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.
## Mitigation
- Update to the latest version of Rack, or
- Remove usage of `Rack::Static`, or
- Ensure that `root:`
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2025-07-23·CVSS 6.5
CVE-2025-25184 [MEDIUM] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
USN-7366-1 fixed vulnerabilities in Rack. This update provides the
corresponding updates for Ubuntu 25.04.
Original advisory details:
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
Instructions: In general, a standard syst
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2025-03-24·CVSS 6.5
CVE-2025-27610 [MEDIUM] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rack: rubygem-rack: Local File Inclusion in Rack::Static
vendor_redhat·2025-03-10·CVSS 7.5
CVE-2025-27610 [HIGH] CWE-23 rack: rubygem-rack: Local File Inclusion in Rack::Static
rack: rubygem-rack: Local File Inclusion in Rack::Static
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.
Debian
CVE-2025-27610: ruby-rack - Rack provides an interface for developing web applications in Ruby. Prior to ver...
vendor_debian·2025·CVSS 7.5
CVE-2025-27610 [HIGH] CVE-2025-27610: ruby-rack - Rack provides an interface for developing web applications in Ruby. Prior to ver...
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitiga
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-10
Published