CVE-2026-34763: Rack Directory Path Disclosure Vulnerability
Summary
CVE-2026-34763: Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory. Affects rack across 3 version ranges.
< 2.2.23
>= 3.0.0.beta1, < 3.1.21
>= 3.2.0, < 3.2.6
Fixed in 2.2.23, 3.1.21 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rack is a modular Ruby web server interface that provides a minimalistic framework for building web applications. It allows developers to create middleware components that can handle HTTP requests and responses. Rack::Directory is a component that serves directory listings for a specified root path. This functionality is useful for serving static files but can lead to security issues if not configured properly. The vulnerability arises when the root path contains regex metacharacters, leading to unintended exposure of the full filesystem path in the directory listing.
Vulnerability Detail
The vulnerability in Rack's Directory component stems from the way it interpolates the configured root path directly into a regular expression. When the root path contains regex metacharacters (like +, *, or .), the prefix stripping fails, potentially exposing the full filesystem path in the HTML output. This can reveal sensitive information about the server's directory structure, usernames, and other deployment details that should remain confidential.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
gem install rack -v 3.2.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.232.2.23gem install rack -v 2.2.23 -
>= 3.0.0.beta1, < 3.1.213.1.21gem install rack -v 3.1.21 -
>= 3.2.0, < 3.2.63.2.6gem install rack -v 3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using Rack::Directory with a root path that contains regex metacharacters. Instead, use a safe, sanitized path that does not include these characters.
Conclusion
The CVE-2026-34763 vulnerability in Rack's Directory component poses a risk of exposing sensitive filesystem paths due to improper handling of regex metacharacters in the configured root path. It is crucial to update to the patched versions of Rack to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for rack →
FAQ
The vulnerability can lead to the exposure of the full server filesystem path, revealing sensitive information about the server's structure and configuration.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up. Simply upload your manifest file like package-lock.json.
Regex metacharacters are special characters in regular expressions that have a specific meaning, such as +, *, ., and others. They can alter the behavior of regex matching.
Yes, you can avoid using Rack::Directory with paths that contain regex metacharacters as a temporary workaround.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
