CVE-2026-125110

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.25 Rack versions prior to 3.1.23 Rack versions prior to 3.2.8

Description Rack::Static serves a path after Utils.clean path info normalization but evaluates header rules against a path that is only URL-decoded. This allows an unauthenticated attacker to request a known file using raw or percent-encoded dot segments, resulting in the file being delivered without path-specific security headers, such as Content-Disposition or Content-Security-Policy. Applications that do not utilize path-specific header rules are not affected.

Recommendations Update to version 2.2.25. Update to version 3.1.23. Update to version 3.2.8.