CVE-2022-29970

Name of the Vulnerable Software and Affected Versions Sinatra versions prior to 2.2.0

Description The issue is related to insufficient path name restrictions in the Ruby Sinatra web application framework, allowing a remote attacker to access confidential data. The vulnerability occurs because Sinatra does not validate that the expanded path matches public dir when serving static files.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.