CVE-2026-34785

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Affected products

Linuxmint, Rack, Red Os, Ubuntu

Rack

< 2.2.23, 3.1.21, 3.2.6

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

0.4% (31th percentile)

Weakness

CWE-187, CWE-200, CWE-552

NVD status

Modified

Published

2026-04-02

No exploit for CVE-2026-34785 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.