Path-Specific Security Header Bypass in Rack Modular Ruby Web Server Interface
CVE-2026-125110
5.3MEDIUM
What is CVE-2026-125110?
An issue has been identified in the Rack modular Ruby web server interface where prior versions improperly handle path normalization in the Rack::Static component. This oversight allows an unauthenticated attacker to access sensitive files via raw or percent-encoded dot segments, potentially circumventing critical path-specific security measures such as Content-Disposition and Content-Security-Policy headers. Applications that utilize specific header rules are not impacted. The issue has been resolved in Rack versions 2.2.25, 3.1.23, and 3.2.8, and it is recommended that users upgrade to these versions to ensure complete protection.
Affected Version(s)
rack < 2.2.25 < 2.2.25
rack >= 3.0, < 3.1.23 < 3.0, 3.1.23
rack >= 3.2, < 3.2.8 < 3.2, 3.2.8