Information Disclosure Vulnerability in Rack Modular Web Server Interface

CVE-2026-34785

What is CVE-2026-34785?

Rack is a modular Ruby web server interface that, prior to specific updates, utilized a simplistic string prefix check for serving static files. This approach can lead to unwanted information disclosure, as it may allow unrelated files to be accessed if their paths begin with the configured prefixes, such as '/css'. For instance, files named '/css-config.env' or '/css-backup.sql' could be served unintentionally from the static root. To address this issue, upgrades to versions 2.2.23, 3.1.21, and 3.2.6 have been made available, mitigating the risk of sensitive information being disclosed.

References