CVE-2026-34763: Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output.