High severity · published Feb 18, 2026
CVE-2026-22860
Rack has a Directory Traversal via Rack:Directory
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
rack · rack
< 2.2.22; >= 3.0.0.beta1, < 3.1.20; >= 3.2.0, < 3.2.5 · source: vendor, NVD
RH
Red Hat 3scale API Management Platform 2 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22860
Patch
https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7
Exploit
https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-22860
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2440737
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22860.json
More from rack
7.5
CVE-2026-34827
Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser
7.5
CVE-2026-34830
Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
7.5
CVE-2026-34829
Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length
7.5
CVE-2026-34826
Rack: Unbounded Range Count in get_byte_ranges Enables DoS
7.5
CVE-2026-34785
Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching