Multiple vulnerabilities reported in Rack Ruby Framework

Security researchers are reporting several vulnerabilities in the Rack Ruby framework that could allow attackers to access sensitive files outside intended directories.

Researchers from OPSWAT have identified three security vulnerabilities in the Rack Ruby framework:

• CVE-2025-27610 (CVSS score: 7.5): A path traversal vulnerability in Rack::Static middleware that could allow unauthenticated attackers to access files outside the designated static file directory
• CVE-2025-27111 (CVSS score: 6.9): An improper neutralization of CRLF sequences vulnerability allowing attackers to manipulate log entries and distort log files
• CVE-2025-25184 (CVSS score: 5.7): Another CRLF injection vulnerability enabling attackers to manipulate log content through malicious header values

Of these vulnerabilities, CVE-2025-27610 poses the most significant risk as it could enable attackers to retrieve sensitive information including configuration files, credentials, and confidential data, potentially leading to serious data breaches.

The path traversal vulnerability in Rack::Static stems from improper handling of the :root option. When this parameter is not explicitly defined, Rack defaults to using the current working directory (Dir.pwd) as the web root. The middleware then directly concatenates incoming URL paths with this directory without sufficient validation or sanitization.

The issue occurs in the request handling process:

1. When Rack::Static receives an HTTP request, the call method is invoked
2. The middleware checks if the request matches configured URL prefixes using can_serve(path) and overwrite_file_path(path)
3. If matched, it constructs a file path by combining the :root directory with the user-supplied PATH_INFO
4. This construction lacks proper path normalization or sanitization
5. If PATH_INFO contains directory traversal sequences (e.g., ../), the resolved path could point to files outside the intended directory

To address these vulnerabilities, users should:

1. Update to the latest version of Rack
2. If immediate patching isn't possible remove usage of Rack::Static