CVE-2026-34763: Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

April 2, 2026 (updated May 13, 2026)

Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output.

References

github.com/advisories/GHSA-7mqq-6cf9-v2qp
github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp
github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34763.yml
nvd.nist.gov/vuln/detail/CVE-2026-34763

Code Behaviors & Features

Detect and mitigate CVE-2026-34763 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →