UBUNTU-CVE-2026-34763: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, , or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.5.2-3+deb8u3ubuntu1~esm11 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.6.4-3ubuntu0.2+esm10 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.6.4-4ubuntu0.2+esm10 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.1.4-5ubuntu1.2+esm3 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.2.7-1ubuntu0.7 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
Rack::Directoryto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
Rack::Directoryto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
Rack::Directoryto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Rack::Directory are exposed when its configured root path contains regular-expression metacharacters such as +, *, or .. The affected Rack versions are those earlier than 2.2.23, 3.1.21, and 3.2.6.
What does an attacker need to do to exploit this vulnerability?
An attacker needs network access to request a directory listing served through Rack::Directory. No privileges or user interaction are required according to the supplied severity vector.
What information can be disclosed?
A successful request can cause the generated directory-listing HTML to reveal the full filesystem path. The provided data describes an information disclosure impact and does not indicate integrity or availability impact.
How can the issue be remediated?
Upgrade Rack to version 2.2.23, 3.1.21, or 3.2.6, as appropriate for the deployed release branch.