Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8zkw-y3yd-yuft
Vulnerability ID VCID-8zkw-y3yd-yuft
Aliases CVE-2020-8161
GHSA-5f9h-9pjv-v6j7
Summary Directory traversal in Rack::Directory app bundled with Rack A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-548 Exposure of Information Through Directory Listing
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8161.json
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
epss 0.00907 https://api.first.org/data/v1/epss?cve=CVE-2020-8161
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-5f9h-9pjv-v6j7
cvssv3.1 8.6 https://github.com/rack/rack
generic_textual HIGH https://github.com/rack/rack
cvssv3.1 8.6 https://github.com/rack/rack/commit/dddb7ad18ed79ca6ab06ccc417a169fde451246e
generic_textual HIGH https://github.com/rack/rack/commit/dddb7ad18ed79ca6ab06ccc417a169fde451246e
cvssv3.1 8.6 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8161.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8161.yml
cvssv3 8.6 https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
cvssv3.1 8.6 https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
generic_textual HIGH https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
cvssv3.1 8.6 https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA
generic_textual HIGH https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA
cvssv3.1 8.6 https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
cvssv3.1 8.6 https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2020-8161
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2020-8161
cvssv3.1 8.6 https://usn.ubuntu.com/4561-1
generic_textual HIGH https://usn.ubuntu.com/4561-1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8161.json
https://api.first.org/data/v1/epss?cve=CVE-2020-8161
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8161
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rack/rack
https://github.com/rack/rack/commit/dddb7ad18ed79ca6ab06ccc417a169fde451246e
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8161.yml
https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA
https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
https://nvd.nist.gov/vuln/detail/CVE-2020-8161
https://usn.ubuntu.com/4561-1
https://usn.ubuntu.com/4561-1/
1838281 https://bugzilla.redhat.com/show_bug.cgi?id=1838281
GHSA-5f9h-9pjv-v6j7 https://github.com/advisories/GHSA-5f9h-9pjv-v6j7
RHSA-2020:4366 https://access.redhat.com/errata/RHSA-2020:4366
USN-4561-2 https://usn.ubuntu.com/4561-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8161.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/rack/rack
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/rack/rack/commit/dddb7ad18ed79ca6ab06ccc417a169fde451246e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8161.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-8161
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://usn.ubuntu.com/4561-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.75703
EPSS Score 0.00907
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:23.053763+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-5f9h-9pjv-v6j7/GHSA-5f9h-9pjv-v6j7.json 38.0.0