TI-2022-22408 CVE-2022-45442 · GHSA-2x8x-jmrp-phxw
Sinatra vulnerable to Reflected File Download attack
Priority HIGH 73
Sinatra is a domain-specific language for creating web applications in Ruby.
Sinatrarb
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Sinatrarb records in CISA KEVNo Sinatrarb vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2022-12310 CVE-2022-29970 · GHSA-qp49-3pvw-x4m5
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Priority LOW 37
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
TI-2018-15772 CVE-2018-1000119 · GHSA-688c-3x49-6rqj
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack…
Priority LOW 31
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed.
TI-2018-08315 CVE-2018-11627 · GHSA-mq35-wqvf-r23c
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Priority LOW 31
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
TI-2018-05228 CVE-2018-7212 · GHSA-h29f-7f56-j8wh
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in…
Priority LOW 28
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows.
TI-2025-38270 CVE-2025-61921 · GHSA-mr3q-g2mv-mr4q
Sinatra has ReDoS vulnerability in ETag header value generation
Priority LOW 20
Sinatra is a domain-specific language for creating web applications in Ruby.