access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-34785 CVE-2026-34785
HIGH
Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
Record summary
CVE-2026-34785 has a selected CVSS score of 7.5 (high).
Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 2, 2026 · Source: CVE List
Affected products and versions
6| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
| CVE List | < 2.2.23 | affected | |
| >= 3.0.0.beta1, < 3.1.21 | affected | ||
| >= 3.2.0, < 3.2.6 | affected | ||
| GitHub Advisory | Before 2.2.23 · Fixed in 2.2.23 | affected | |
| 3.0.0.beta1 to < 3.1.21 · Fixed in 3.1.21 | affected | ||
| 3.2.0 to < 3.2.6 · Fixed in 3.2.6 | affected | ||
References
7RHBZ#2454486issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2454486 github.com
https://github.com/rack/rack github.comConfirmation
https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34785.yml nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-34785 security.access.redhat.comx_sadp csaf vex
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34785.json