Rack EUVD-2026-18380

The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates low-to-moderate real-world risk: the attack vector is network-based with low complexity, requires no authentication or user interaction, and has limited impact (confidentiality only, no integrity or availability harm). However, the practical risk depends on deployment context. This is not a high-priority emergency because exploitation requires the administrator to have configured a root path containing regex metacharacters (a relatively uncommon edge case), and the information disclosed is the filesystem path itself-useful for reconnaissance but not direct code execution. The EPSS score and POC availability were not provided in the intelligence data. SSVC analysis suggests this is exploitable but requires specific misconfiguration; patch deployment should follow normal update cycles rather than emergency protocols. Organizations using Rack with unusual root path configurations (e.g., paths containing '+', '*', or '.') should prioritize patching; standard deployments with alphanumeric paths face minimal risk.

An attacker discovers a Ruby web application running an older version of Rack with directory listings enabled (via Rack::Directory). The application administrator has configured the root path as '/var/www/app+v1' (containing a '+' regex metacharacter). When the attacker requests the directory listing URL (e.g., GET /), the vulnerable Rack::Directory fails to correctly strip the root prefix due to the unescaped '+' in the regex pattern, and the HTML response includes the full path '/var/www/app+v1' instead of the expected relative path. The attacker now knows the exact filesystem layout, aiding further reconnaissance for other vulnerabilities.