CVE-2026-22860: Rack has a Directory Traversal via Rack:Directory

Summary

Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../rootexample/ can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root.

Details

In directory.rb, File.expandpath(File.join(root, pathinfo)).startwith?(root) does not enforce a path boundary. If the server root is /var/www/root, a path like /var/www/rootbackup passes the check because it shares the same prefix, so Rack::Directory will list that directory also.

Impact

Information disclosure via directory listing outside the configured root when Rack::Directory is exposed to untrusted clients and a directory shares the root prefix (e.g., public2, wwwbackup).

Mitigation

Update to a patched version of Rack that correctly checks the root prefix. Don't name directories with the same prefix as one which is exposed via Rack::Directory.