Rack Vulnerable to Path Traversal (GHSA-85r7-w5mv-c849)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-0262
Severity: MODERATE · CWE: CWE-22

`rack/file.rb` (`Rack::File`) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted `PATH_INFO` environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

Affected packages:
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 1.5.0
fixed: 1.5.2
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 1.4.0
fixed: 1.4.5