Read the docs
TI-2025-20419 Aliases CVE-2025-27610GHSA-7wqh-767x-r66v

Local File Inclusion in Rack::Static

Priority MEDIUM 41CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 7 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-23 and the CVSS impact.

Summary

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01173 67th percentileScored 2026-11-07
Fix Partial rack (rack): 2.2.13, 3.0.14, 3.1.12rack (RubyGems): 2.2.13, 3.0.14, 3.1.12Red Hat: 6 advisoriesRed Hat: 7 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rackrackbefore 2.2.13; 3.0 to before 3.0.14; 3.1 to before 3.1.122.2.13, 3.0.14, 3.1.12Patch availableCNA
—rack (RubyGems)before 2.2.132.2.13Patch availableGHSA-7wqh-767x-r66v
—rack (RubyGems)3.0 to before 3.0.143.0.14Patch availableGHSA-7wqh-767x-r66v
—rack (RubyGems)3.1 to before 3.1.123.1.12Patch availableGHSA-7wqh-767x-r66v
  • rack Vendorrack Affected before 2.2.13; 3.0 to before 3.0.14; 3.1 to before 3.1.12 Fixed in 2.2.13, 3.0.14, 3.1.12 Patch available CNA
  • rack (RubyGems) Vendor— Affected before 2.2.13 Fixed in 2.2.13 Patch available GHSA-7wqh-767x-r66v
  • rack (RubyGems) Vendor— Affected 3.0 to before 3.0.14 Fixed in 3.0.14 Patch available GHSA-7wqh-767x-r66v
  • rack (RubyGems) Vendor— Affected 3.1 to before 3.1.12 Fixed in 3.1.12 Patch available GHSA-7wqh-767x-r66v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*before 2.2.13; 3.0.0 to before 3.0.14; 3.1.0 to before 3.1.12Vulnerablerack
  • cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions before 2.2.13; 3.0.0 to before 3.0.14; 3.1.0 to before 3.1.12 Vulnerable ·rack

Remediation

  • Fix · CNA rack (rack) Fixed in 2.2.13, 3.0.14, 3.1.12
  • Fix · GHSA-7wqh-767x-r66v rack (RubyGems) Fixed in 2.2.13 Advisory →
  • Fix · GHSA-7wqh-767x-r66v rack (RubyGems) Fixed in 3.0.14 Advisory →
  • Fix · GHSA-7wqh-767x-r66v rack (RubyGems) Fixed in 3.1.12 Advisory →

Red Hat 6 advisories

  • RHSA-2025:4576 Released 2025-05-06 · Red Hat rating Important
    Satellite 6.17.0 release
    • Red Hat Satellite 6.17 for RHEL 9 python-django-4.2.19-1.el9pc, python-jinja2-3.1.5-1.el9pc, python3.11-django-4.2.19-1.el9pc +3
  • RHSA-2025:3906 Released 2025-04-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.9.13
    • RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
  • RHSA-2025:3448 Released 2025-04-02 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.8.19
    • RHOL 5.8 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/elasticsearch-operator-bundle +14
Show 3 more Red Hat advisories
  • RHSA-2025:3490 Released 2025-04-01 · Red Hat rating Important
    Satellite 6.16.4 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 rubygem-graphql-1.13.24-1.el8sat, rubygem-rack-2.2.13-1.el8sat
    • Red Hat Satellite 6.16 for RHEL 9 rubygem-graphql-1.13.24-1.el9sat, rubygem-rack-2.2.13-1.el9sat
  • RHSA-2025:3492 Released 2025-04-01 · Red Hat rating Important
    Satellite 6.14.4.5 Async Update
    • Red Hat Satellite 6.14 for RHEL 8 rubygem-graphql-1.13.24-1.el8sat, rubygem-rack-2.2.13-1.el8sat
  • RHSA-2025:3491 Released 2025-04-01 · Red Hat rating Important
    Satellite 6.15.5.2 Async Update
    • Red Hat Satellite 6.15 for RHEL 8 python-jinja2-3.1.5-1.el8pc, python3.11-jinja2-3.1.5-1.el8pc, rubygem-graphql-1.13.24-1.el8sat +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
RHOL 5.8 for RHEL 9Fixed RHSA-2025:3448
RHOL 5.9 for RHEL 9Fixed RHSA-2025:3906
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2025:3492
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2025:3491
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2025:3490
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2025:3490
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2025:4576
Not affected: 9 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Satellite 6.14 for RHEL 8
  • Red Hat Satellite 6.15 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27610
  2. 2026-10-03 Alias added: GHSA-7wqh-767x-r66v

References

Patch 1

Advisory 2

Other 3

  • TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
  • TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
  • TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
  • TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
  • TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences