Red Hat EUVD-2026-18380

Rack is a modular Ruby web server interface specification (CGI/Rack implemented in gems like WEBrick, Puma, etc.). The vulnerability resides in the Rack::Directory class, which generates HTML directory listings for web-accessible directories. When computing the displayed directory path, Rack::Directory constructs a regular expression to strip the configured root prefix from the full filesystem path. CWE-625 (Permissive Regular Expression) indicates the root cause: the regex pattern is built by directly interpolating the root path string without escaping regex metacharacters. If the root parameter contains characters like '+', '*', '.', '[', or other regex operators, those characters are interpreted as regex syntax rather than literal strings, causing the prefix-stripping regex to fail or match unintended paths. This results in the full filesystem path being included in the HTML output instead of the relative directory path.