RACK · CVE-2026-125110 · Package
FIX → 3.2.8 · 2.2.25 +1
Rack::Static matches header_rules against a path that is only URL-decoded, while serving the normalized file, so dot-segment requests skip rules. An unauthenticated attacker can fetch a protected file without the security headers configured for it, such as Content-Disposition or a restrictive Content-Security-Policy.
first public Oct 30, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Rack::Static with path-specific header_rules to attach security headers to particular files or file types, especially for serving untrusted uploads. Apps that do not use header_rules, or that serve no sensitive static files, are not exposed.
Not affected if managed-hosting, no-header-rules, static-export
Who cares rack, rails, ruby, rubygems, self-hosted
bundle list rack or look at Gemfile.lock for rack.Rack::Static and header_rules; if none are used, the issue does not apply.Rack::Static normalizes the request path with Utils.clean_path_info when deciding which file to serve, but matches header_rules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for that file's location are not applied.
This allows an attacker to receive a protected static file without the security headers configured for it.
Rack::Static#call computes the served path as Utils.clean_path_info(Utils.unescape_path(path)). Rack::Static#applicable_rules applies only Utils.unescape_path before testing string and regular expression rules. A request for /assets/../uploads/file.html or /assets/..%2fuploads/file.html is served as uploads/file.html, but the decoded path /assets/../uploads/file.html does not start with , so a rule scoped to that directory never matches.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 3.2.8 · 2.2.25 +1
< 2.2.25: move to 2.2.25>= 3.0, < 3.1.23: move to 3.1.23>= 3.2, < 3.2.8: move to 3.2.8uploadsThe fix for CVE-2026-34786 (GHSA-q4qf-9j86-f5mh) added URL decoding to rule matching but did not add dot segment normalization, so versions that include that fix remain affected.
Applications that use Rack::Static header_rules to attach security-relevant headers to particular paths or file types are affected. An unauthenticated attacker who knows the path of a protected file can request it through a dot segment path and receive it without those headers, for example without Content-Disposition: attachment or a restrictive Content-Security-Policy that prevents uploaded HTML from rendering inline. The file itself is served unchanged. Applications that do not use path-specific header_rules are not affected.
header_rules are matched against the same normalized path used to serve the file.Rack::Static header_rules to prevent inline rendering of untrusted uploads; serve them from a separate origin.