CVE-2026-22860

🗓️ 18 Feb 2026 18:45:02Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 98 Views🌐 WEB

Rack::Directory path traversal escapes root with /../path; fixed in 2.2.22, 3.1.20, 3.2.5.

Reporter	Title	Published	Views	Family All 202
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been addressed in IBM Aspera Shares	27 Mar 202615:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affects IBM License Metric Tool v9	26 Mar 202611:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	6 Mar 202620:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Console	12 Mar 202620:43	–	ibm
AstraLinux	Astra Linux – Vulnerability in Ruby-Rack	24 Aug 202610:19	–	astralinux
BDU FSTEC	The vulnerability of the modular interface between web servers and web applications in Rack, related to incorrect path name restrictions for the restricted directory, allows attackers to gain unauthorized access to protected information.	25 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-22860 vulnerabilities	20 Feb 202601:17	–	cgr
Circl	CVE-2026-22860	18 Feb 202619:25	–	circl
CNNVD	Rack 安全漏洞	18 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-22860 Rack has a Directory Traversal via Rack:Directory	18 Feb 202618:45	–	cvelist

NVD

Vulners

Node

rack rackRange<2.2.22ruby

rack rackRange3.0.0–3.1.20ruby

rack rackRange3.2.0–3.2.5ruby

[
  {
    "vendor": "rack",
    "product": "rack",
    "versions": [
      {
        "version": "< 2.2.22",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0.beta1, < 3.1.20",
        "status": "affected"
      },
      {
        "version": ">= 3.2.0, < 3.2.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7
github	www.github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh
access	www.access.redhat.com/security/cve/CVE-2026-22860
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22860.json
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

Parameter	Position	Path	Description	CWE
path	path	/../root_example/	Directory traversal via Rack::Directory path check allowing escape of the configured root using a manipulated path such as /../root_example/.	CWE-22CWE-548

15 Jul 2026 02:18Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5

EPSS0.00676

SSVC