Rack::Directory Path Disclosure Pre-2.2.23, 3.1.21, 3.2.6
CVE-2026-34763 Published on April 2, 2026
Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Vulnerability Analysis
CVE-2026-34763 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Permissive Regular Expression
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
Products Associated with CVE-2026-34763
stack.watch emails you whenever new vulnerabilities are published in Rack or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
rack:- Version < 2.2.23 is affected.
- Version >= 3.0.0.beta1, < 3.1.21 is affected.
- Version >= 3.2.0, < 3.2.6 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.