Rack CVE-2026-34785

Rack versions prior to 2.2.23, 3.1.21, or 3.2.6 with Rack::Static configured with URL prefixes (e.g., '/css'). Remote unauthenticated attacker can request unrelated paths sharing the prefix (e.g., '/css-config.env') to access unintended static files. No victim interaction required.

This represents a genuine medium-to-high priority vulnerability despite the 7.5 CVSS score. The CVSS vector indicates worst-case scenario with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and high confidentiality impact (C:H). However, real-world exploitability depends heavily on configuration choices and file naming conventions at the document root. The vulnerability requires specific conditions: administrators must configure Rack::Static with short prefix strings AND sensitive files must exist with names sharing those prefixes. EPSS data not provided, but the straightforward nature of exploitation (simple path manipulation) and confirmed patch availability suggest moderate real-world risk. No CISA KEV listing indicates no confirmed active exploitation campaigns. The information disclosure nature limits immediate system compromise but could enable reconnaissance for multi-stage attacks. Organizations using Rack for static file serving with prefix-based configuration should prioritize remediation, while those using different static serving approaches or full path specifications face minimal risk.

An attacker identifies a Ruby web application using Rack::Static configured to serve CSS files from '/css'. They enumerate common sensitive file patterns by requesting paths like '/css-config.env', '/css-backup.sql', '/css.env.production', or '/cssadmin.json'. If any files matching these patterns exist in the static root directory, Rack::Static incorrectly serves them due to the flawed prefix check. The attacker successfully retrieves database credentials from '/css-backup.sql' or API keys from '/css-config.env', gaining authentication credentials for backend systems. This information disclosure enables lateral movement or privilege escalation in subsequent attack stages.