Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-jg77-mm5c-gydu
Vulnerability ID VCID-jg77-mm5c-gydu
Aliases CVE-2026-34763
GHSA-7mqq-6cf9-v2qp
Summary Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-625 Permissive Regular Expression
CWE-41 Improper Resolution of Path Equivalence
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34763.json
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2026-34763
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2026-34763
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2026-34763
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2026-34763
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2026-34763
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2026-34763
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2026-34763
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7mqq-6cf9-v2qp
cvssv3.1 5.3 https://github.com/rack/rack
generic_textual MODERATE https://github.com/rack/rack
cvssv3.1 5.3 https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
cvssv3.1_qr MODERATE https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
generic_textual MODERATE https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
ssvc Track https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-34763
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-34763
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34763.json
https://api.first.org/data/v1/epss?cve=CVE-2026-34763
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34763
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rack/rack
https://nvd.nist.gov/vuln/detail/CVE-2026-34763
2454498 https://bugzilla.redhat.com/show_bug.cgi?id=2454498
GHSA-7mqq-6cf9-v2qp https://github.com/advisories/GHSA-7mqq-6cf9-v2qp
GHSA-7mqq-6cf9-v2qp https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34763.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/rack/rack
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-02T17:41:04Z/ Found at https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34763
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07801
EPSS Score 0.00028
Published At April 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-03T02:49:29.942754+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34763.json 38.1.0