CVE-2026-22860

CVE-2026-22860 is a directory traversal vulnerability in Rack, a Ruby web server interface, affecting versions prior to 2.2.22, 3.1.20, and 3.2.5. An attacker can exploit a flaw in Rack::Directory's path checking to escape the configured root directory and potentially list contents outside the intended scope. This vulnerability carries a CVSS score of 7.5 (HIGH) due to its network-based attack vector and high confidentiality impact, requiring no user interaction or privileges. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, indicating awareness.