CVE-2026-22860

Executive Summary

CVE-2026-22860 is a path traversal vulnerability in the Rack::Directory component of the Rack Ruby web server interface. The vulnerability allows an attacker to bypass directory restrictions by crafting a request like /../root_example/ that escapes the configured root directory if the target path starts with the root string. This can lead to unauthorized directory listing and information disclosure. The vulnerability affects Rack versions prior to 2.2.22, 3.1.20, and 3.2.5. The CVSS score is 7.5 (High), and no public exploit code or PoC has been identified at this time.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a critical component in the Ruby ecosystem used by many web frameworks including Ruby on Rails. Organizations using Rack should immediately update to patched versions to prevent potential supply chain attacks where an attacker could exploit this vulnerability to enumerate directory structures and discover sensitive files or configuration details.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Directory listing can expose sensitive file and directory names.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service impact.

Threat Level: High (7.5) – The vulnerability is easy to exploit and can lead to significant information disclosure.

Deep Dive & Mechanics

The vulnerability resides in the Rack::Directory middleware, which is used to serve static files from a specified root directory. The path validation logic incorrectly uses a string prefix match on the expanded path. This means that if the configured root is /var/www/root_example, a request to /../root_example/ will be expanded to /var/www/root_example/../root_example/, which resolves to /var/www/root_example/. However, due to the flawed prefix check, the middleware may treat this as a valid path within the root, allowing directory listing outside the intended root.

The core issue is that the code checks if the expanded path starts with the root string, but does not ensure that the path is actually within the root directory. An attacker can craft a path that, after normalization, still starts with the root string but points to a parent directory.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 2.2.22, < 3.1.20, < 3.2.5):

def call(env)
  path = Rack::Utils.unescape_path(env[Rack::PATH_INFO])
  expanded_path = File.expand_path(path, @root)
  if expanded_path.start_with?(@root)
    # serve directory listing
  else
    # reject
  end
end

Patched Code (Rack >= 2.2.22, >= 3.1.20, >= 3.2.5):

def call(env)
  path = Rack::Utils.unescape_path(env[Rack::PATH_INFO])
  expanded_path = File.expand_path(path, @root)
  if expanded_path == @root || expanded_path.start_with?(@root + "/")
    # serve directory listing
  else
    # reject
  end
end

The fix adds a check for a trailing slash after the root path, ensuring that the expanded path is either exactly the root or starts with the root followed by a separator. This prevents the prefix match from being fooled by paths that start with the root string but are actually outside it.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of Rack (e.g., gem install rack -v 3.1.19).
2. Create a simple Rack application that uses Rack::Directory:

   # config.ru
   require 'rack'
   use Rack::Directory, '/var/www/root_example'
   run lambda { |env| [200, {'Content-Type' => 'text/plain'}, ['Hello']] }
   

3. Start the server: rackup config.ru -p 8080.

Exploitation:

• Send a crafted request to list directories outside the root:

  GET /../root_example/ HTTP/1.1
  Host: target:8080
  

• If the root is /var/www/root_example, this request will list the contents of /var/www/ instead of /var/www/root_example/.
• To enumerate further, use paths like /../root_example/../../etc/ to traverse deeper.

Blue Team

Detection:

• Monitor web server logs for unusual path traversal patterns, especially requests containing ../ sequences.
• Look for requests where the path after normalization starts with the configured root but contains parent directory references.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately update Rack to a patched version.
• If immediate patching is not possible, implement a WAF rule to block requests containing ../ in the path.
• Restrict directory listing to only necessary directories and disable Rack::Directory if not required.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with paths containing /../ followed by the root directory name (e.g., /../root_example/).
  • Unusual directory listing responses from the server.
• File System IOCs:
  • Unexpected access to files outside the intended root directory.
  • Log entries showing directory listing of sensitive directories (e.g., /etc, /var/log).
• Log IOCs:
  • Web server access logs showing multiple requests with path traversal patterns.
  • Error logs indicating attempts to access restricted directories.

Detection Engineering

YARA Rule

rule CVE_2026_22860_Rack_Directory_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Rack::Directory vulnerability CVE-2026-22860"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $traversal = "/../"
        $root_pattern = /\/\.\.\/[a-zA-Z0-9_]+\//
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-22860 Rack Directory Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2026-22860 path traversal in Rack::Directory
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/../"
    condition: selection
falsepositives:
    - Legitimate use of parent directory references in some applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-22860 Rack Directory Traversal Attempt"; flow:to_server,established; content:"/../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update Rack to version 2.2.22, 3.1.20, or 3.2.5 or later.
2. Workaround: If patching is not immediately possible, disable Rack::Directory or implement a custom middleware that validates paths more strictly.
3. WAF Rules: Deploy web application firewall rules to block requests containing ../ sequences.
4. Monitoring: Enable detailed logging and monitor for path traversal attempts.
5. Least Privilege: Ensure that the web server runs with minimal file system permissions to limit the impact of directory listing.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert