CVE-2026-25500
published 2026-02-18CVE-2026-25500: Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.22%
13.2th percentile
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-rack | < ruby-rack 2.2.22-0+deb12u1 (bookworm) | ruby-rack 2.2.22-0+deb12u1 (bookworm) |
| rack | rack | < 2.2.22 | 2.2.22 |
| rack | rack | — | — |
| rack | rack | — | — |
| rack | rack | >= 0 < 2.2.22 | 2.2.22 |
| rack | rack | >= 3.0.0 < 3.1.20 | 3.1.20 |
| rack | rack | >= 3.0.0.beta1 < 3.1.20 | 3.1.20 |
| rack | rack | >= 3.2.0 < 3.2.5 | 3.2.5 |
| rack | rack | >= 3.2.0 < 3.2.5 | 3.2.5 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2026-02-26·CVSS 7.5
CVE-2026-25500 [HIGH] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
Minh Pham Quang discovered that Rack did not correctly handle parsing
certain paths, which could lead to a path traversal attack. An attacker
could possibly use this issue to leak sensitive information.
(CVE-2026-22860)
Ali Firas discovered that Rack did not correctly sanitize certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-25500)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rubygem-rack: Rack stored XSS in Rack::Directory
vendor_redhat·2026-02-18·CVSS 5.4
CVE-2026-25500 [MEDIUM] CWE-79 rubygem-rack: Rack stored XSS in Rack::Directory
rubygem-rack: Rack stored XSS in Rack::Directory
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
A cross site scripting vulnerability has been discovered in the rubygem Rack. Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename
Debian
CVE-2026-25500: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, a...
vendor_debian·2026·CVSS 5.4
CVE-2026-25500 [MEDIUM] CVE-2026-25500: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, a...
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Scope: local
bookworm: resolved (fixed in 2.2.22-0+deb12u1)
bullseye: resolved (fixed in 2.1.4-3+deb11u5)
forky: resolved (fixed in 3.2.5-1)
sid: resolved (fixed in 3.2.5-1)
trixie: resolved (fixed in 3.1.20-0+deb13u1)
OSV
ruby-rack vulnerabilities
osv·2026-02-26·CVSS 7.5
CVE-2026-22860 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
Minh Pham Quang discovered that Rack did not correctly handle parsing
certain paths, which could lead to a path traversal attack. An attacker
could possibly use this issue to leak sensitive information.
(CVE-2026-22860)
Ali Firas discovered that Rack did not correctly sanitize certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-25500)
OSV
CVE-2026-25500: Rack is a modular Ruby web server interface
osv·2026-02-18·CVSS 5.4
CVE-2026-25500 [MEDIUM] CVE-2026-25500: Rack is a modular Ruby web server interface
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
GHSA
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
ghsa·2026-02-17
CVE-2026-25500 [MEDIUM] CWE-79 Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
## Summary
`Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index includes an anchor whose `href` attribute is exactly `javascript:alert(1)`. Clicking this entry executes arbitrary JavaScript in the context of the hosting application.
This results in a client-side XSS condition in directory listings generated by `Rack::Directory`.
## Details
`Rack::Directory` renders directory entries using an HTML row template similar to:
```html
%s
```
The `%s` placeholder is populated directly with the file’s basename. If the basename begin
OSV
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
osv·2026-02-17
CVE-2026-25500 [MEDIUM] Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
## Summary
`Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index includes an anchor whose `href` attribute is exactly `javascript:alert(1)`. Clicking this entry executes arbitrary JavaScript in the context of the hosting application.
This results in a client-side XSS condition in directory listings generated by `Rack::Directory`.
## Details
`Rack::Directory` renders directory entries using an HTML row template similar to:
```html
%s
```
The `%s` placeholder is populated directly with the file’s basename. If the basename begin
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-25500 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.4
CVE-2026-25500 [MEDIUM] CVE-2026-25500 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25500 :
Ruby vulnerability analysis and mitigation
Rack::Directory
javascript:
javascript:alert(1)
href
javascript:alert(1)
alert(1)
Source : NVD
## 5.4
Score
Published February 18, 2026
Severity MEDIUM
CNA Score 5.4
Affected Technologies
Ruby
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
ruby3.2-rails-7.2
ruby3.3-rails-7.1
Sources
NVD
Chainguard Has Fix Added at: Feb 20, 2026
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Feb 19, 2026
Echo Severity MEDIUM Has Fix Added at: Feb 19, 2026
RubyGems Severity MEDIUM Has Fix Added at: Feb 18, 2026
Homebrew Severity MEDIUM Ha
Bugzilla
CVE-2026-25500 rubygem-rack: Rack stored XSS in Rack::Directory
bugzilla·2026-02-18·CVSS 5.4
CVE-2026-25500 [MEDIUM] CVE-2026-25500 rubygem-rack: Rack stored XSS in Rack::Directory
CVE-2026-25500 rubygem-rack: Rack stored XSS in Rack::Directory
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
2026-02-18
Published