Rack EUVD-2026-18390

The CVSS v3.1 score of 5.9 with vector AV:N/AC:H/PR:N/UI:N reflects a network-accessible vulnerability with high complexity and no privilege or interaction requirements, yielding high confidentiality impact. However, the attack complexity (AC:H) is the primary limiting factor, indicating that successful exploitation requires specific configuration preconditions: the backend must actively use Rack::Sendfile with x-accel-redirect support, and the attacker must be able to inject the X-Accel-Mapping header into requests reaching the middleware. The vulnerability is fundamentally a path traversal/file exposure issue rather than remote code execution. Real-world risk depends heavily on nginx configuration-only deployments with internal location blocks configured for x-accel-redirect acceleration are affected. The AC:H rating accurately reflects the requirement to understand and manipulate regex patterns and knowledge of the backend's internal file structure. Absence of reported public exploit code and active exploitation (no CISA KEV status) suggests this is a measured-risk issue affecting primarily high-touch deployments rather than mass-exploitable.

An attacker sends a crafted HTTP request with a malicious X-Accel-Mapping header to a web application using Rack::Sendfile with nginx x-accel-redirect enabled. The attacker constructs a regex payload that breaks out of the intended path pattern and matches paths served from an unintended internal nginx location, such as one serving configuration files, source code, or other sensitive assets. When the middleware processes the request, the unescaped header value is interpolated into the regex, causing nginx to redirect and serve a file the attacker should not access. For example, an attacker might inject regex wildcards or character classes to match /config/database.yml instead of /public/downloads/file.pdf. Successful exploitation requires knowledge of the backend's file structure and configured internal locations, explaining the high attack complexity rating.