rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ruby-rack | Jul 30, 2024 | Feb 8, 2013 |
| Freebsd | — | Upgrade rubygem19-rackUpgrade rubygem18-rack | Dec 10, 2025 | Feb 17, 2013 |
| Gentoo Linux | — | Upgrade dev-ruby/rack. | Oct 30, 2017 | Feb 8, 2013 |
| Suse | — | Upgrade rubygem-activesupport-3_2Upgrade rubygem-actionpack-2_3-docUpgrade rubygem-rack-1_4Upgrade rubygem-railties-3_2-docUpgrade rubygem-rack-1_1Upgrade rubygem-actionmailer-2_3Upgrade rubygem-rack-1_3-docUpgrade rubygem-rails-3_2Upgrade rubygem-activesupport-2_3Upgrade rubygem-railsUpgrade rubygem-activemodel-3_2Upgrade rubygem-rack-1_2Upgrade rubygem-actionmailer-2_3-testsuiteUpgrade rubygem-activerecord-3_2Upgrade rubygem-actionpackUpgrade rubygem-rails-3_2-docUpgrade rubygem-railties-3_2Upgrade rubygem-actionpack-2_3Upgrade rubygem-rack-1_2-testsuiteUpgrade rubygem-actionmailer-3_2-docUpgrade rubygem-activeresourceUpgrade rubygem-rack-1_4-docUpgrade rubygem-rails-2_3Upgrade rubygem-activeresource-2_3-testsuiteUpgrade rubygem-rack-1_1-docUpgrade rubygem-rails-2_3-docUpgrade rubygem-rack-1_4-testsuiteUpgrade rubygem-rack-1_3-testsuiteUpgrade rubygem-activesupportUpgrade rubygem-activerecord-2_3-testsuiteUpgrade rubygem-activeresource-3_2-docUpgrade rubygem-rack-1_2-docUpgrade rubygem-activerecord-3_2-docUpgrade rubygem-activemodel-3_2-docUpgrade rubygem-activeresource-3_2Upgrade rubygem-actionpack-3_2-docUpgrade rubygem-actionpack-2_3-testsuiteUpgrade rubygem-activerecord-2_3-docUpgrade rubygem-activesupport-2_3-docUpgrade rubygem-activeresource-2_3Upgrade rubygem-actionpack-3_2Upgrade rubygem-activerecordUpgrade rubygem-activeresource-2_3-docUpgrade rubygem-actionmailer-2_3-docUpgrade rubygem-actionmailerUpgrade rubygem-rack-1_3Upgrade rubygem-actionmailer-3_2Upgrade rubygem-activerecord-2_3Upgrade rubygem-rack-1_1-testsuiteUpgrade rubygem-activesupport-3_2-doc | Dec 12, 2013 | Feb 8, 2013 |
| Ubuntu | — | Upgrade ruby-rack | Nov 19, 2024 | Feb 8, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub