Skip to content
Fencer Vulns
high 7.5

CVE-2025-27610 json

Local File Inclusion in Rack::Static

published 2025-03-10 19 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-7800 , GHSA-7wqh-767x-r66v

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.

Patch / fix

  • rubygems rack 2.2.13, 3.0.14, 3.1.12
  • rack rack 2.2.13, 3.0.14, 3.1.12
  • rack_project rack 2.2.13, 3.0.14, 3.1.12
  • ruby-rack Debian 12 2.2.13-1~deb12u1
  • ruby-rack Debian 14, Debian 13 3.1.12-1

debian advisories DEBIAN-CVE-2025-27610

  • ruby-rack Ubuntu 24.04 LTS 2.2.7-1ubuntu0.2
  • ruby-rack Ubuntu 26.04 LTS, Ubuntu 25.10 3.1.16-0.1
  • ruby-rack Ubuntu Pro 14.04 LTS 1.5.2-3+deb8u3ubuntu1~esm9
  • ruby-rack Ubuntu Pro 16.04 LTS 1.6.4-3ubuntu0.2+esm7
  • ruby-rack Ubuntu Pro 18.04 LTS 1.6.4-4ubuntu0.2+esm7
  • ruby-rack Ubuntu Pro 20.04 LTS 2.0.7-2ubuntu0.1+esm6
  • ruby-rack Ubuntu Pro 22.04 LTS 2.1.4-5ubuntu1.1+esm1

ubuntu advisories UBUNTU-CVE-2025-27610

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rubygem-rack satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 2.2.13-1.el9sat
  • python-django satellite capsule 6.17, satellite 6.17 4.2.19-1.el9pc
  • python-jinja2 satellite capsule 6.17, satellite 6.17 3.1.5-1.el9pc
  • rubygem-graphql satellite 6.17, satellite 6.16 1.13.24-1.el9sat
  • python3.11-django satellite capsule 6.17, satellite 6.17 4.2.19-1.el9pc
  • python3.11-jinja2 satellite capsule 6.17, satellite 6.17 3.1.5-1.el9pc
  • rubygem-rack satellite capsule 6.16, satellite capsule 6.15, satellite capsule 6.14 +3 more 2.2.13-1.el8sat
  • python-jinja2 satellite capsule 6.15, satellite 6.15 3.1.5-1.el8pc

red hat advisories RHSA-2025:4576RHSA-2025:3491RHSA-2025:3492RHSA-2025:3490

  • rubygem-rack SLE High Availability Extension 15 SP6, SLE High Availability Extension 15 SP5, SLE High Availability Extension 15 SP4 +2 more 2.0.8-150000.3.26.1
  • rubygem-rack-1_6 openSUSE Leap 15.6 1.6.8-150000.3.3.1

suse advisories SUSE-SU-2025:0874-1SUSE-SU-2025:0858-1

  • rubygem-rack-2.2 openSUSE Tumbleweed 2.2.22-1.1
  • rubygem-rack-2.2 openSUSE Tumbleweed 2.2.13-1.1

opensuse advisories openSUSE-SU-2026:10286-1openSUSE-SU-2025:14876-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-27610 updated cvss 7.5

rack: rubygem-rack: Local File Inclusion in Rack::Static

  • Red Hat 3scale API Management Platform 2 3scale-amp2/zync-rhel9 Red Hat Satellite 6 rubygem-rack Red Hat Storage 3 rubygem-rack
    affected: workaround, no fix available
  • Red Hat Satellite 6.14 for RHEL 8 rubygem-rack 2.2.13-1.el8sat
    fixed: vendor fix RHSA-2025:3492
  • Red Hat Satellite 6.15 for RHEL 8 rubygem-rack 2.2.13-1.el8sat
    fixed: vendor fix RHSA-2025:3491
  • Red Hat Satellite 6.16 for RHEL 8 rubygem-rack 2.2.13-1.el8sat Red Hat Satellite 6.16 for RHEL 9 rubygem-rack 2.2.13-1.el9sat
    fixed: vendor fix RHSA-2025:3490
  • Red Hat Satellite 6.17 for RHEL 9 rubygem-rack 2.2.13-1.el9sat
    fixed: vendor fix RHSA-2025:4576
  • Red Hat RHOL 5.8 for RHEL 9 openshift-logging/fluentd-rhel9 v5.8.19-5, openshift-logging/vector-rhel9 v0.28.1-94, openshift-logging/eventrouter-rhel9 v0.4.0-361, openshift-logging/logging-loki-rhel9 v3.3.2-32, openshift-logging/loki-rhel9-operator v5.8.19-9, openshift-logging/opa-openshift-rhel9 v0.1.0-375, +11 more
    fixed: vendor fix RHSA-2025:3448
  • Red Hat RHOL 5.9 for RHEL 9 openshift-logging/fluentd-rhel9 v5.9.13-5, openshift-logging/vector-rhel9 v0.34.1-37, openshift-logging/eventrouter-rhel9 v0.4.0-363, openshift-logging/logging-loki-rhel9 v3.3.2-36, openshift-logging/loki-rhel9-operator v5.9.13-9, openshift-logging/opa-openshift-rhel9 v0.1.0-383, +6 more
    fixed: vendor fix RHSA-2025:3906
  • Red Hat Enterprise Linux 7 pcs, pcs-snmp, python-clufter Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat Enterprise Linux 9 pcs, pcs-snmp Red Hat Enterprise Linux 10 pcs
    not affected: vulnerable code cannot be controlled by adversary
show 1 more
  • Red Hat Satellite 6.14 for RHEL 8 satellite 6.14.4.5-1.el8sat, satellite-cli 6.14.4.5-1.el8sat, rubygem-graphql 1.13.24-1.el8sat, satellite-common 6.14.4.5-1.el8sat, satellite-capsule 6.14.4.5-1.el8sat Red Hat Satellite 6.15 for RHEL 8 python-jinja2 3.1.5-1.el8pc, satellite 6.15.5.2-1.el8sat, python-pulpcore 3.39.25-1.el8pc, python3.11-jinja2 3.1.5-1.el8pc, satellite-cli 6.15.5.2-1.el8sat, rubygem-graphql 1.13.24-1.el8sat, +4 more Red Hat Satellite 6.16 for RHEL 8 foreman 3.12.0.7-1.el8sat, satellite 6.16.4-1.el8sat, foreman-cli 3.12.0.7-1.el8sat, foreman-ec2 3.12.0.7-1.el8sat, foreman-pcp 3.12.0.7-1.el8sat, satellite-cli 6.16.4-1.el8sat, +20 more Red Hat Satellite 6.16 for RHEL 9 foreman 3.12.0.7-1.el9sat, satellite 6.16.4-1.el9sat, foreman-cli 3.12.0.7-1.el9sat, foreman-ec2 3.12.0.7-1.el9sat, foreman-pcp 3.12.0.7-1.el9sat, satellite-cli 6.16.4-1.el9sat, +20 more Red Hat Satellite 6.17 for RHEL 9 cjson 1.7.17-1.el9sat, katello 4.16.0-1.el9sat, libcomps 0.1.21-1.el9pc, python-jq 1.8.0-1.el9pc, python-idna 3.10-1.el9pc, python-pbr 6.1.0-1.el9pc, +673 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
rubygems rack
<2.2.13
>=3.0, <3.0.14
>=3.1, <3.1.12
2.2.13
3.0.14
3.1.12

Affected products

  • rack rack

Classification

Weakness
  • CWE-23 Relative Path Traversal

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.