{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/51535?format=json","vulnerability_id":"VCID-csrd-u9cz-u7ak","summary":"Local File Inclusion in Rack::Static\n## Summary\n\n`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.\n\n## Details\n\nThe vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.\n\n## Impact\n\nBy exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.\n\n## Mitigation\n\n- Update to the latest version of Rack, or\n- Remove usage of `Rack::Static`, or\n- Ensure that `root:` points at a directory path which only contains files which should be accessed publicly.\n\nIt is likely that a CDN or similar static file server would also mitigate the issue.","aliases":[{"alias":"CVE-2025-27610"},{"alias":"GHSA-7wqh-767x-r66v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/127546?format=json","purl":"pkg:deb/debian/ruby-rack@2.1.4-3%2Bdeb11u2?distro=trixie","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3nmb-xetr-6qbg"},{"vulnerability":"VCID-6ydb-e746-vbd8"},{"vulnerability":"VCID-e8ab-9br9-6ybt"},{"vulnerability":"VCID-ewfc-rx8b-jfc4"},{"vulnerability":"VCID-gnc7-wp69-h7ag"},{"vulnerability":"VCID-h8af-h199-qqfz"},{"vulnerability":"VCID-hpw3-uw3x-mqgq"},{"vulnerability":"VCID-p3dy-qbad-q3ab"},{"vulnerability":"VCID-pydr-47y4-y3fu"},{"vulnerability":"VCID-r1hk-cy5k-9kad"},{"vulnerability":"VCID-tc69-2tad-43cv"},{"vulnerability":"VCID-u1u4-7b3v-fue7"},{"vulnerability":"VCID-uh69-24kx-xucy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-rack@2.1.4-3%252Bdeb11u2%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/127571?format=json","purl":"pkg:deb/debian/ruby-rack@2.1.4-3%2Bdeb11u3?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-rack@2.1.4-3%252Bdeb11u3%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/127570?format=json","purl":"pkg:deb/debian/ruby-rack@2.2.13-1~deb12u1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-rack@2.2.13-1~deb12u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/127544?format=json","purl":"pkg:deb/debian/ruby-rack@2.2.22-0%2Bdeb12u1?distro=trixie","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3nmb-xetr-6qbg"},{"vulnerability":"VCID-6ydb-e746-vbd8"},{"vulnerability":"VCID-e8ab-9br9-6ybt"},{"vulnerability":"VCID-ewfc-rx8b-jfc4"},{"vulnerability":"VCID-gnc7-wp69-h7ag"},{"vulnerability":"VCID-h8af-h199-qqfz"},{"vulnerability":"VCID-hpw3-uw3x-mqgq"},{"vulnerability":"VCID-p3dy-qbad-q3ab"},{"vulnerability":"VCID-pydr-47y4-y3fu"},{"vulnerability":"VCID-r1hk-cy5k-9kad"},{"vulnerability":"VCID-tc69-2tad-43cv"},{"vulnerability":"VCID-u1u4-7b3v-fue7"},{"vulnerability":"VCID-uh69-24kx-xucy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-rack@2.2.22-0%252Bdeb12u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/127572?format=json","purl":"pkg:deb/debian/ruby-rack@3.1.12-1?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-rack@3.1.12-1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/127549?format=json","purl":"pkg:deb/debian/ruby-rack@3.1.20-0%2Bdeb13u1?distro=trixie","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3nmb-xetr-6qbg"},{"vulnerability":"VCID-6ydb-e746-vbd8"},{"vulnerability":"VCID-e8ab-9br9-6ybt"},{"vulnerability":"VCID-ewfc-rx8b-jfc4"},{"vulnerability":"VCID-gnc7-wp69-h7ag"},{"vulnerability":"VCID-h8af-h199-qqfz"},{"vulnerability":"VCID-hpw3-uw3x-mqgq"},{"vulnerability":"VCID-p3dy-qbad-q3ab"},{"vulnerability":"VCID-pydr-47y4-y3fu"},{"vulnerability":"VCID-r1hk-cy5k-9kad"},{"vulnerability":"VCID-tc69-2tad-43cv"},{"vulnerability":"VCID-u1u4-7b3v-fue7"},{"vulnerability":"VCID-uh69-24kx-xucy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-rack@3.1.20-0%252Bdeb13u1%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/127547?format=json","purl":"pkg:deb/debian/ruby-rack@3.2.6-2?distro=trixie","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-rack@3.2.6-2%3Fdistro=trixie"},{"url":"http://public2.vulnerablecode.io/api/packages/84289?format=json","purl":"pkg:gem/rack@2.2.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jru-u17n-tyg1"},{"vulnerability":"VCID-7cef-z5qm-afd8"},{"vulnerability":"VCID-amfu-8d25-juhy"},{"vulnerability":"VCID-bj83-rx84-v3g9"},{"vulnerability":"VCID-dss4-6ptr-83av"},{"vulnerability":"VCID-e11g-k7zm-vkhu"},{"vulnerability":"VCID-k8fr-zuyx-yyhg"},{"vulnerability":"VCID-x373-rhh4-7khm"},{"vulnerability":"VCID-xpa3-1n87-8ucv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.13"},{"url":"http://public2.vulnerablecode.io/api/packages/84290?format=json","purl":"pkg:gem/rack@3.0.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jru-u17n-tyg1"},{"vulnerability":"VCID-7cef-z5qm-afd8"},{"vulnerability":"VCID-bj83-rx84-v3g9"},{"vulnerability":"VCID-dss4-6ptr-83av"},{"vulnerability":"VCID-e11g-k7zm-vkhu"},{"vulnerability":"VCID-k8fr-zuyx-yyhg"},{"vulnerability":"VCID-x373-rhh4-7khm"},{"vulnerability":"VCID-xpa3-1n87-8ucv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.0.14"},{"url":"http://public2.vulnerablecode.io/api/packages/84291?format=json","purl":"pkg:gem/rack@3.1.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jru-u17n-tyg1"},{"vulnerability":"VCID-7cef-z5qm-afd8"},{"vulnerability":"VCID-bj83-rx84-v3g9"},{"vulnerability":"VCID-dss4-6ptr-83av"},{"vulnerability":"VCID-e11g-k7zm-vkhu"},{"vulnerability":"VCID-k8fr-zuyx-yyhg"},{"vulnerability":"VCID-x373-rhh4-7khm"},{"vulnerability":"VCID-xpa3-1n87-8ucv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.12"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/75642?format=json","purl":"pkg:gem/rack@2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jru-u17n-tyg1"},{"vulnerability":"VCID-3nmb-xetr-6qbg"},{"vulnerability":"VCID-6ydb-e746-vbd8"},{"vulnerability":"VCID-bj83-rx84-v3g9"},{"vulnerability":"VCID-csrd-u9cz-u7ak"},{"vulnerability":"VCID-dss4-6ptr-83av"},{"vulnerability":"VCID-e11g-k7zm-vkhu"},{"vulnerability":"VCID-e8ab-9br9-6ybt"},{"vulnerability":"VCID-ewfc-rx8b-jfc4"},{"vulnerability":"VCID-h8af-h199-qqfz"},{"vulnerability":"VCID-k8fr-zuyx-yyhg"},{"vulnerability":"VCID-p1cf-naeh-bbgx"},{"vulnerability":"VCID-p3dy-qbad-q3ab"},{"vulnerability":"VCID-r1hk-cy5k-9kad"},{"vulnerability":"VCID-tc69-2tad-43cv"},{"vulnerability":"VCID-uh69-24kx-xucy"},{"vulnerability":"VCID-vk15-7qdb-xkh9"},{"vulnerability":"VCID-x373-rhh4-7khm"},{"vulnerability":"VCID-xpa3-1n87-8ucv"},{"vulnerability":"VCID-y6nj-8y3j-hbfw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.3"},{"url":"http://public2.vulnerablecode.io/api/packages/70809?format=json","purl":"pkg:gem/rack@3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jru-u17n-tyg1"},{"vulnerability":"VCID-csrd-u9cz-u7ak"},{"vulnerability":"VCID-e11g-k7zm-vkhu"},{"vulnerability":"VCID-p1cf-naeh-bbgx"},{"vulnerability":"VCID-vk15-7qdb-xkh9"},{"vulnerability":"VCID-y6nj-8y3j-hbfw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.0"},{"url":"http://public2.vulnerablecode.io/api/packages/70747?format=json","purl":"pkg:gem/rack@3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-csrd-u9cz-u7ak"},{"vulnerability":"VCID-dss4-6ptr-83av"},{"vulnerability":"VCID-k8fr-zuyx-yyhg"},{"vulnerability":"VCID-p1cf-naeh-bbgx"},{"vulnerability":"VCID-vk15-7qdb-xkh9"},{"vulnerability":"VCID-xpa3-1n87-8ucv"},{"vulnerability":"VCID-y6nj-8y3j-hbfw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1"},{"url":"http://public2.vulnerablecode.io/api/packages/107686?format=json","purl":"pkg:rpm/redhat/rubygem-rack@2.2.13-1?arch=el8sat","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-csrd-u9cz-u7ak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/rubygem-rack@2.2.13-1%3Farch=el8sat"},{"url":"http://public2.vulnerablecode.io/api/packages/107687?format=json","purl":"pkg:rpm/redhat/rubygem-rack@2.2.13-1?arch=el9sat","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-csrd-u9cz-u7ak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/rubygem-rack@2.2.13-1%3Farch=el9sat"}],"references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27610.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27610.json"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/rack/rack","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rack/rack"},{"reference_url":"https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-11T15:22:45Z/"}],"url":"https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583"},{"reference_url":"https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-11T15:22:45Z/"}],"url":"https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100444","reference_id":"1100444","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100444"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351231","reference_id":"2351231","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351231"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27610","reference_id":"CVE-2025-27610","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27610"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-27610.yml","reference_id":"CVE-2025-27610.YML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-27610.yml"},{"reference_url":"https://github.com/advisories/GHSA-7wqh-767x-r66v","reference_id":"GHSA-7wqh-767x-r66v","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7wqh-767x-r66v"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:3448","reference_id":"RHSA-2025:3448","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:3448"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:3490","reference_id":"RHSA-2025:3490","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:3490"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:3491","reference_id":"RHSA-2025:3491","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:3491"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:3492","reference_id":"RHSA-2025:3492","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:3492"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:3906","reference_id":"RHSA-2025:3906","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:3906"},{"reference_url":"https://access.redhat.com/errata/RHSA-2025:4576","reference_id":"RHSA-2025:4576","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2025:4576"}],"weaknesses":[{"cwe_id":23,"name":"Relative Path Traversal","description":"The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"7.0 - 8.9","exploitability":"0.5","weighted_severity":"8.0","risk_score":4.0,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-csrd-u9cz-u7ak"}